Analysis
-
max time kernel
28s -
max time network
23s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
19/07/2024, 19:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FunCheker.vmp.exe
Resource
win10-20240611-en
windows10-1703-x64
7 signatures
150 seconds
General
-
Target
FunCheker.vmp.exe
-
Size
12.3MB
-
MD5
2483b4f60ae4b57ea7b2253b09f86a6d
-
SHA1
8cfc70fd727e2ce5aead6554409d62f758bfc7dd
-
SHA256
f4f2affbb3d24127b8d637fdf65b68fdf35eed22ddc8ca4d88089d0d2a60d507
-
SHA512
f97380b3a3f08098e5d57ac6999cc07214f167029399e799fffe9819451ef1ff95b930a6f5479fe7fafbc76246cb657f0ca2c05eacf6f84a39c1063fb162a782
-
SSDEEP
393216:dvCJF8HKsrSKRXHvvcdizDr1f7IAbtI3Cn:dvK8XX7zDr1sRyn
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1820 FunCheker.vmp.exe 1820 FunCheker.vmp.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1820 FunCheker.vmp.exe 1820 FunCheker.vmp.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4584 taskmgr.exe Token: SeSystemProfilePrivilege 4584 taskmgr.exe Token: SeCreateGlobalPrivilege 4584 taskmgr.exe Token: 33 4584 taskmgr.exe Token: SeIncBasePriorityPrivilege 4584 taskmgr.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe -
Suspicious use of SendNotifyMessage 51 IoCs
pid Process 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FunCheker.vmp.exe"C:\Users\Admin\AppData\Local\Temp\FunCheker.vmp.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1820
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4584