Analysis
-
max time kernel
60s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 19:23
General
-
Target
WatchDog K.exe
-
Size
2.3MB
-
MD5
704fe0147a1496b6140a019eae4a8aaf
-
SHA1
6ec2af193407f28b152e309f3121ab9e5811f151
-
SHA256
eb42bfde1da78603c16eb85a4c9219d658dbdd660524413c788db85166014d5d
-
SHA512
68773884793b7345d5920d256da70b27266370898edd8b4caaa388c2fc03f857778f08616a43a6bc18c137bc73f7974d93444d28b7cd8a96170755dff89bf953
-
SSDEEP
49152:1LZ5/j23veRjH9BY6xrYhwYQ6QXDnW4XVYJ4KgtnjsRgDku:hamFHcCchmzW0YJ49FsRgDku
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
WatchDog K.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ WatchDog K.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
WatchDog K.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion WatchDog K.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion WatchDog K.exe -
Processes:
resource yara_rule behavioral1/memory/4788-0-0x0000000000A30000-0x0000000001031000-memory.dmp themida behavioral1/memory/4788-3-0x0000000000A30000-0x0000000001031000-memory.dmp themida -
Processes:
WatchDog K.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WatchDog K.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
WatchDog K.exepid process 4788 WatchDog K.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 4132 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4132 taskmgr.exe Token: SeSystemProfilePrivilege 4132 taskmgr.exe Token: SeCreateGlobalPrivilege 4132 taskmgr.exe Token: 33 4132 taskmgr.exe Token: SeIncBasePriorityPrivilege 4132 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
Processes:
taskmgr.exepid process 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
Processes:
taskmgr.exepid process 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe 4132 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WatchDog K.exe"C:\Users\Admin\AppData\Local\Temp\WatchDog K.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4788
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4132
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4132-12-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4132-4-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4132-5-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4132-6-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4132-16-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4132-15-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4132-14-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4132-13-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4132-10-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4132-11-0x000001C555800000-0x000001C555801000-memory.dmpFilesize
4KB
-
memory/4788-1-0x0000000077974000-0x0000000077976000-memory.dmpFilesize
8KB
-
memory/4788-3-0x0000000000A30000-0x0000000001031000-memory.dmpFilesize
6.0MB
-
memory/4788-0-0x0000000000A30000-0x0000000001031000-memory.dmpFilesize
6.0MB