Analysis
-
max time kernel
1367s -
max time network
1152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 19:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AutoDox.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
1800 seconds
General
-
Target
AutoDox.exe
-
Size
81KB
-
MD5
ec51cfbde4a4df4eceb8313adf8d93ca
-
SHA1
f8925a067c34ab1b0e7da2de961af20247ace3fa
-
SHA256
aef13f3ec8abf777929e42aa3de86774ab8362f7fbfcc0475c7b912ce253c002
-
SHA512
1cc6c73c33ce6d00c102f9ed3c6733c532f131b00761fd4ff59cda87c560e3ce3e06dfcbb8a886976ae5084c9d36c3f02d9afefca5b1403c20b53735fe24bada
-
SSDEEP
1536:9rsgf4VFHlI++UIoyjyCL6sf+Fle8Ifvl1loJbh76e:ClI++UIZIsf+Fle8Ift1loJbh76
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoDox.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2636 taskmgr.exe Token: SeSystemProfilePrivilege 2636 taskmgr.exe Token: SeCreateGlobalPrivilege 2636 taskmgr.exe Token: 33 2636 taskmgr.exe Token: SeIncBasePriorityPrivilege 2636 taskmgr.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe -
Suspicious use of SendNotifyMessage 51 IoCs
pid Process 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe 2636 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoDox.exe"C:\Users\Admin\AppData\Local\Temp\AutoDox.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1356
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2636