Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 20:51
Static task
static1
Behavioral task
behavioral1
Sample
e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe
-
Size
5.2MB
-
MD5
bbaf30b4bd747847c35191bdd91e06fe
-
SHA1
62ce5e88d7af4a7a3a93c22c701432d8652e0185
-
SHA256
e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89
-
SHA512
fa6a4e87cd2b15a558fc53cc719769a7b5aa34aeb165be5cd997c75921467e95386297e96ba010020661b29307999d858479996b083c3f7ff3e206d61c3702b1
-
SSDEEP
98304:cPovmj3mjeYbulkJgjfpSDoDQtSRANxlDxGXe2DKD7uwIvNWLEP9l6wCerK:nmj3mjeEQjktl/UDk7urvNWL6u
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: 33 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe Token: SeIncBasePriorityPrivilege 2692 e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe"C:\Users\Admin\AppData\Local\Temp\e559652de2010cfc951bdd2d17ae719f7ea2fd1ce5163a87a3642016e4391f89.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692