Analysis
-
max time kernel
62s -
max time network
22s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
19/09/2024, 04:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
程序安装_Setup.exe
Resource
win10-20240611-en
windows10-1703-x64
6 signatures
300 seconds
General
-
Target
程序安装_Setup.exe
-
Size
4.9MB
-
MD5
b944dbebe358d84f77ee18c17c26d8a1
-
SHA1
d59163f3b857ad4e882846cdb2ede9db182cae2d
-
SHA256
1c2a0295006f12f4194fd789bcad2f13f17182f683483c2ae72528a8d13ff075
-
SHA512
78055519599ff91571d85e8a882d599113f55061a98ba6689db5a7001982c3de7a4d0ecd8505745dfe28828c35e78c9194dfb1a4e03b0048a53dc6647c8ddf1a
-
SSDEEP
98304:ui+5bdQcGWDBGNZnHUs3VyPdSWGbRLJq:5adDGWsNZnHUs3VyPdpsRV
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2632 taskmgr.exe Token: SeSystemProfilePrivilege 2632 taskmgr.exe Token: SeCreateGlobalPrivilege 2632 taskmgr.exe Token: 33 2632 taskmgr.exe Token: SeIncBasePriorityPrivilege 2632 taskmgr.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe -
Suspicious use of SendNotifyMessage 29 IoCs
pid Process 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\程序安装_Setup.exe"C:\Users\Admin\AppData\Local\Temp\程序安装_Setup.exe"1⤵PID:4728
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2632