Overview
overview
8Static
static
3LoaderV6/A...wk.dll
windows11-21h2-x64
1LoaderV6/A...ci.dll
windows11-21h2-x64
1LoaderV6/A...ui.dll
windows11-21h2-x64
1LoaderV6/WMPNSSUI.dll
windows11-21h2-x64
1LoaderV6/loaderV6.exe
windows11-21h2-x64
8LoaderV6/mpvis.dll
windows11-21h2-x64
1LoaderV6/wmpnssci.dll
windows11-21h2-x64
1Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-07-2024 19:43
Static task
static1
Behavioral task
behavioral1
Sample
LoaderV6/Additions/wmpnetwk.dll
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
LoaderV6/Additions/wmpnssci.dll
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
LoaderV6/Additions/wmpnssui.dll
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
LoaderV6/WMPNSSUI.dll
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
LoaderV6/loaderV6.exe
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
LoaderV6/mpvis.dll
Resource
win11-20240709-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
LoaderV6/wmpnssci.dll
Resource
win11-20240709-en
windows11-21h2-x64
General
-
Target
LoaderV6/Additions/wmpnetwk.dll
-
Size
32KB
-
MD5
8cd455334b6cdd06beeeb898e1e83052
-
SHA1
e104ab973744bac982efa50f055a5a45daed2aee
-
SHA256
5270f60d90a15ce9d728c328495fb714daa1267a7363a70225badfa252a38ad0
-
SHA512
922f329f32d935946490cb7ff409689f2c2610fd09efe7e9e095a6e10aee838dde585aa6cbc4e816c42c7a61aa989daf3633edd553ed4a355d7eed6225091859
-
SSDEEP
192:400xT+MOj4Edw+bRFCPkzMTYEwdwbFS33eWTqa2ilecbAvyv/PjxNlMopnTXmCly:400xvnyK9EN5VlVECXIWeF
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3700 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3700 Taskmgr.exe Token: SeSystemProfilePrivilege 3700 Taskmgr.exe Token: SeCreateGlobalPrivilege 3700 Taskmgr.exe Token: SeSecurityPrivilege 3700 Taskmgr.exe Token: SeTakeOwnershipPrivilege 3700 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe 3700 Taskmgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\LoaderV6\Additions\wmpnetwk.dll,#11⤵PID:4128
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3700