Analysis
-
max time kernel
78s -
max time network
81s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
10-07-2024 12:30
Behavioral task
behavioral1
Sample
AkrienPremiumCrack.zip
Resource
win10-20240404-en
windows10-1703-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
AkrienPremium.exe
Resource
win10-20240404-en
windows10-1703-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
Crack.exe
Resource
win10-20240404-en
windows10-1703-x64
17 signatures
150 seconds
General
-
Target
AkrienPremiumCrack.zip
-
Size
312KB
-
MD5
431e487b11513783fbec3858169b6041
-
SHA1
d52b846d43015d219bab3d96f62809b0ceed7cfd
-
SHA256
471eeb9eeca3a3fb5bc949d95ddc7a29a8910a10b7567e725fc212c86c616b10
-
SHA512
a8709c23eb53afaf5af8731a8bd0673c4e7a66b09240386c9d2a87e125c3ea744357dd5df80b47e67d3e93d87d95067edd3b3fc0601ff1377b475f552ad059ff
-
SSDEEP
6144:g6r0R7lHL1q4r+hFDnDXuzXhS4P3T1QHTR/00Cu4DKcts8zaQOsk:pIhZY4r+zDezXDmTR/tb4+cO0aQQ
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5096 taskmgr.exe Token: SeSystemProfilePrivilege 5096 taskmgr.exe Token: SeCreateGlobalPrivilege 5096 taskmgr.exe Token: 33 5096 taskmgr.exe Token: SeIncBasePriorityPrivilege 5096 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe 5096 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.zip1⤵PID:4188
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5096