Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 07:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hrkill.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
hrkill.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
hrkill.exe
-
Size
384KB
-
MD5
06639a10b4d585d0833bd7807bde5047
-
SHA1
bd91cb9b3714504d7f22ae4970617dd7f41e0f00
-
SHA256
c974d6ff56c2c6e1624b680d11296c61dbd17d13106df8b7beb2c68a123c0021
-
SHA512
a91b74d673df5a448607618ca5a6914658eb5139c75cc547d773e41dffcff4dcf3cf979815331544829d822ba38c93c076b735ed11c039800474eefead9b6c04
-
SSDEEP
6144:FLd/bh1akjsbQ+9rJl/VohGH8077vS3jbqr7EyGb7QAh+:FLZV11jsbQcll/WQc077SzbyIbT+
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3292 2524 WerFault.exe 82 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1944 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1944 taskmgr.exe Token: SeSystemProfilePrivilege 1944 taskmgr.exe Token: SeCreateGlobalPrivilege 1944 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe 1944 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hrkill.exe"C:\Users\Admin\AppData\Local\Temp\hrkill.exe"1⤵PID:2524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 12562⤵
- Program crash
PID:3292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2524 -ip 25241⤵PID:4960
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1944