Analysis

  • max time kernel
    113s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2024 05:55

General

  • Target

    goodbyedpi-0.2.3rc1-2/goodbyedpi-0.2.3rc1/x86/WinDivert64.sys

  • Size

    89KB

  • MD5

    6a33620de63bccaf5e5314ee49cd58fb

  • SHA1

    ac728b339681b2e27099fecc1419821f01d04b34

  • SHA256

    e69b5ba3f0cd6cfb2983e442636e7f0b342b61b15264b0328317d4559c82cf50

  • SHA512

    638d1b8aa4dc0e4ac504f51aaa3ec8375ccc3d69a4d36821f6bb98060b58586007f47966b9d58d222b9f067e12e80755f56559286cbabec8746146acaf24f945

  • SSDEEP

    1536:8ovgCRgYL/h//oJJw5AdPtey2AyWpdsihch9WXi2v6MuO2:84jmJJsKle9A5pdsiqg/vsO2

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.3rc1-2\goodbyedpi-0.2.3rc1\x86\WinDivert64.sys
    1⤵
      PID:4860
      • C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.3rc1-2\goodbyedpi-0.2.3rc1\x86\WinDivert64.sys
        C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.3rc1-2\goodbyedpi-0.2.3rc1\x86\WinDivert64.sys
        2⤵
          PID:3768
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5000

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/5000-0-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB

      • memory/5000-1-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB

      • memory/5000-2-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB

      • memory/5000-7-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB

      • memory/5000-12-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB

      • memory/5000-11-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB

      • memory/5000-10-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB

      • memory/5000-9-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB

      • memory/5000-8-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB

      • memory/5000-6-0x0000019DC3A00000-0x0000019DC3A01000-memory.dmp

        Filesize

        4KB