Analysis
-
max time kernel
69s -
max time network
74s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-09-2024 17:39
Behavioral task
behavioral1
Sample
Kopx_Perm.exe
Resource
win11-20240802-en
windows11-21h2-x64
10 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
Kopx_Perm.exe
-
Size
5.5MB
-
MD5
2179430234960bd608dfb64dea7c9a61
-
SHA1
90644ec6e9d67e955d08479559e0712fc66f0c49
-
SHA256
781b2aa75d9ab21381e403cdf4d6a12a355e1ae27865a88ba99b65b0614bb378
-
SHA512
b9ccf87f319dd95df5d5468b6e4980b246ab92f09085094602bc9ce86952a45c8fa7b826a06f5b42fa7781a17d37fe70e426444c7f825ff1bbf77314fafe06a1
-
SSDEEP
49152:/FFnhVgBFnhVSr9JkzvkjXa+FnhVSr9JkzvkjXabsBFnhVKTTFBySg6etzcwp8fz:/VrkzgXyrkzgX9orG8farRQ
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Kopx_Perm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Kopx_Perm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Kopx_Perm.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "34" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4728 Kopx_Perm.exe Token: SeDebugPrivilege 1480 taskmgr.exe Token: SeSystemProfilePrivilege 1480 taskmgr.exe Token: SeCreateGlobalPrivilege 1480 taskmgr.exe Token: 33 1480 taskmgr.exe Token: SeIncBasePriorityPrivilege 1480 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe 1480 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2256 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kopx_Perm.exe"C:\Users\Admin\AppData\Local\Temp\Kopx_Perm.exe"1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1480
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1524
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39d6855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2256