Analysis
-
max time kernel
434s -
max time network
437s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
3434.jpg
Resource
win7-20240705-en
windows7-x64
2 signatures
600 seconds
Behavioral task
behavioral2
Sample
3434.jpg
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
600 seconds
General
-
Target
3434.jpg
-
Size
8KB
-
MD5
10a46a20c4450cfe007f5f68e12d7873
-
SHA1
8bb6fca2366c097573e30ebf33118c529ee22aa2
-
SHA256
971df10ec16ca9bdb77fea3ca1b8bb58606f3510f51aa69457d556da0e68b25d
-
SHA512
35cd53bb0660a68e3ae9d3784719071d626ad909c3bd3f5ef9b922c4d5a453a1603f3effc77b31c4d5b60164e415367aaecc4081322a0a96e8daa9676ffbdcb8
-
SSDEEP
192:ewok1sF4KlS/qiL6EWvhN90GRnA7I6vuuViRZ3GeKYu3IbXA6c:ewok1sF4Kpc6lhN7e862uVEuwFc
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 460 taskmgr.exe Token: SeSystemProfilePrivilege 460 taskmgr.exe Token: SeCreateGlobalPrivilege 460 taskmgr.exe Token: 33 460 taskmgr.exe Token: SeIncBasePriorityPrivilege 460 taskmgr.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\3434.jpg1⤵PID:3520
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:460