Analysis
-
max time kernel
113s -
max time network
143s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/09/2024, 14:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
comet.exe
Resource
win11-20240802-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
key.txt
Resource
win11-20240802-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
key.txt
-
Size
21B
-
MD5
f85e5fbb76a76152431dac646cc3aecc
-
SHA1
846cfa0fbb8a0c24cadc87c99e098bcd4193cd42
-
SHA256
e678114aca9c68f97df8b3d5522601327815515b62735e99496e89da0e4ccdae
-
SHA512
5bef7e839229f76611834d1499317680d7e0f74c2899c0750124854cc23837a414c1462d9777c270b229a7bb9e7d54f66ddad6ceca9f367dc5f27f8b86781569
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings cmd.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4280 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1768 taskmgr.exe Token: SeSystemProfilePrivilege 1768 taskmgr.exe Token: SeCreateGlobalPrivilege 1768 taskmgr.exe Token: 33 1768 taskmgr.exe Token: SeIncBasePriorityPrivilege 1768 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4264 wrote to memory of 4280 4264 cmd.exe 82 PID 4264 wrote to memory of 4280 4264 cmd.exe 82
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\key.txt1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\key.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4280
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1768