Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 12:21
Behavioral task
behavioral1
Sample
140000000.ngen.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
140000000.ngen.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
140000000.ngen.exe
-
Size
7.9MB
-
MD5
dc1cb58795a488ae04b4eb85ee945a2e
-
SHA1
5e0ced2cbc103f492171f0898aeb7a4bd444c54d
-
SHA256
90ff2afb6a4a07c4174be011a38a9db876f2ac77b1bf45e74cb60f8c123453f1
-
SHA512
d84ad249dcdbe28b659b54a2adc0dd23e9a692faa4de874617b7201497f58460bf1bb5c3edc81ba249caefbf55023505a9473fa5a7bca8013ff6f66e26086bc5
-
SSDEEP
98304:NHjJcetx2WKUcuIBjyHS7M4NrZdQ/UxBq0L56CVtM3g1fiZri6BFAD045y4Ni:ketx2Td0KBq09jXLfwi6v5iy48
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1384 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1384 taskmgr.exe Token: SeSystemProfilePrivilege 1384 taskmgr.exe Token: SeCreateGlobalPrivilege 1384 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe 1384 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\140000000.ngen.exe"C:\Users\Admin\AppData\Local\Temp\140000000.ngen.exe"1⤵PID:4384
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:4016