Resubmissions
04-07-2024 00:14
240704-aja8yatdpj 1004-07-2024 00:13
240704-ahtc5atdmp 1004-07-2024 00:12
240704-ag9cysvgma 1004-07-2024 00:05
240704-adjywstbnr 1003-07-2024 23:40
240703-3n1cvascrn 1003-07-2024 23:38
240703-3mqr1stere 10Analysis
-
max time kernel
239s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 23:40
Behavioral task
behavioral1
Sample
Lowkey/Lowkey/LowkeySpoofer.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
23 signatures
300 seconds
Behavioral task
behavioral2
Sample
discord_token_grabber.pyc
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral3
Sample
passwords_grabber.pyc
Resource
win10v2004-20240611-en
windows10-2004-x64
10 signatures
300 seconds
General
-
Target
passwords_grabber.pyc
-
Size
7KB
-
MD5
bbb6ab7b8230cca0ac46532a612143d0
-
SHA1
4bf5ebb19c5807cfb4b48191ec65b329d67763cd
-
SHA256
8655f8885fa28c9633563e0264e65206eae277fb020f85a836be27f0fc3d7ec4
-
SHA512
21353818de5a2e192bcdb38e0765b675258ae733eb634c1b01fbf53dc22946b0eee127c975be7a63d20a8db2b87521fe0ed85f2ec09dcc2f3adf5a7fea0b180e
-
SSDEEP
192:h114qWLfhuUIxzOK2cxDJb+XUhetovxEPz:V4qWLfMtzVxDAEW7
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 764 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 404 taskmgr.exe Token: SeSystemProfilePrivilege 404 taskmgr.exe Token: SeCreateGlobalPrivilege 404 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe 992 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 992 wrote to memory of 764 992 OpenWith.exe 100 PID 992 wrote to memory of 764 992 OpenWith.exe 100
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc1⤵
- Modifies registry class
PID:4432
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc2⤵
- Opens file in notepad (likely ransom note)
PID:764
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD537afae32ec83ce5cf1be12776bc76336
SHA1884c8b0253433a4ae85b4435c66390463845749c
SHA256d5dd2efb317d3cab54af79b452c3eddd0bca08ecede216f5656dac25d5c1fcc4
SHA5124735c7798955e1c429420ac49ca2ab07a17c9127eb3171230e6e649ea77505a963ff82e814de76d3523ac3203adb6cba1364fa66dc8890dbcef896dddc4cd04b