Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
winrar-x64-701.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
winrar-x64-701.exe
-
Size
3.8MB
-
MD5
b8987382bc6af84e51a46ce8bf8a5ec7
-
SHA1
637e210e35792643ab0f809027bfd1de72197358
-
SHA256
9a631ceb4b4c25c92f25080f026396f87891cca894c5f8dd1fac869d17e1a291
-
SHA512
b3a214dfb1f908eb73c3faa60c7f9433a88fd2b808fb431e5b0efe88bf832070f55bcb74094a06b12fb268251ddee87a77d3072b551fa898c74a5094c237fa2b
-
SSDEEP
98304:sNRBOBfKSQIm9EOGw8vjh9Ac9nUNu9KshBvcF+yHrAU:2R/SmeOKv7Ac9n0kq
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4228 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4228 taskmgr.exe Token: SeSystemProfilePrivilege 4228 taskmgr.exe Token: SeCreateGlobalPrivilege 4228 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe 4228 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4784 winrar-x64-701.exe 4784 winrar-x64-701.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe"C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:4784
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4228