Analysis
-
max time kernel
269s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 07:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Hoic/hoic2.1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Hoic/hoic2.1.exe
-
Size
8.5MB
-
MD5
451c94a23536dcbba422d7612b34b6ff
-
SHA1
0b419c8b9f60cb9cb8957a6dbccb393b5d072e43
-
SHA256
3c9806f8e132917ef85512505fadaca733e5523c271dd2e2a6925ddb9c3d0df0
-
SHA512
b777963ab9d21efa29528e6a126e616088205aff9e1b63453c731966dccf5f15cf30f17a933d40c98347a2d057b5f2cb40e40847f41476f0f212b28ce12e94de
-
SSDEEP
49152:XKgsEyTPOoMjJWPDYtoAoB81BE7nNeHhkD9d5VGokmPh2U69mNGkpETUPSGvVuWs:TsEaQWrYtlKheZmq9ANP61tmf
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hoic2.1.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2956 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2956 taskmgr.exe Token: SeSystemProfilePrivilege 2956 taskmgr.exe Token: SeCreateGlobalPrivilege 2956 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2008 hoic2.1.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hoic\hoic2.1.exe"C:\Users\Admin\AppData\Local\Temp\Hoic\hoic2.1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2008
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2956