Resubmissions
08/08/2024, 14:08
240808-rfx2zayake408/08/2024, 14:06
240808-reqw9svaqj308/08/2024, 14:03
240808-rc4eksxhpc4Analysis
- max time kernel
112s - max time network
79s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
08/08/2024, 14:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Void server boost/void server boost.exe
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
- Target Void server boost/void server boost.exe
- Size 1.0MB
- Sample240808-rc4eksxhpc
- SHA256 a18628e8080b21bf266abf4f571063abba2207ac2d999993541a0f49176b4801
- MD5 ce1c66fbc99abd29ad81c5d064e0f966
- SHA1 72394086d1916da3697e8513672e09f59a1ff907
- SHA512 fca61fcb62742b33b46f7d6e73bcb6f0d841f7b96845e0578a36541945e7ada2eeefc812d698093935aa0809518178f764e0d04bcf889031abea4fd1f0f9621a
- SSDEEP 24576:njih34xvK2EW2rLZHSIa6agTRpnnJMOr2I7cimoi1Cu:nO34xyD9L9LagThXr2+Vm
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 640 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1112 taskmgr.exe Token: SeSystemProfilePrivilege 1112 taskmgr.exe Token: SeCreateGlobalPrivilege 1112 taskmgr.exe Token: 33 1112 taskmgr.exe Token: SeIncBasePriorityPrivilege 1112 taskmgr.exe - Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 4472 void server boost.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe - Suspicious use of SendNotifyMessage 37 IoCs
pid Process 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"1⤵
- Suspicious use of FindShellTrayWindow
PID:4472
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4148
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1112
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Void server boost\config.txt1⤵PID:672