Analysis
-
max time kernel
1799s -
max time network
1151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 01:15
Behavioral task
behavioral1
Sample
Days Gone v1.0-v1.04 Plus 35 Trainer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
1800 seconds
General
-
Target
Days Gone v1.0-v1.04 Plus 35 Trainer.exe
-
Size
1.3MB
-
MD5
d06b29acf88fdcc2f5dd049b2311967b
-
SHA1
b9910bccd7546409a270f7299d9f1287311d6215
-
SHA256
81830016defdd03ae9756b258ef6fd458bdf657bb4a3aa35d1a00268e2ec19e7
-
SHA512
e50a2060e642fb7c823e53758a4ade6a96ea7f44ac8e17757c433b7a9a4dfe39ab39aade1e12773f9b13fb45d30eae0e5bffabb555987dd2c2757178b7788910
-
SSDEEP
24576:95G91srHmUv5pSTKoGB9pKYW3LGPdXR1r33tVDSDfsbJ7:DHmiTSGoapg36lhtdlV7
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 3872 taskmgr.exe 3872 taskmgr.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 3872 taskmgr.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 3872 taskmgr.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 3872 taskmgr.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 3872 taskmgr.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3872 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3144 Days Gone v1.0-v1.04 Plus 35 Trainer.exe Token: SeDebugPrivilege 3872 taskmgr.exe Token: SeSystemProfilePrivilege 3872 taskmgr.exe Token: SeCreateGlobalPrivilege 3872 taskmgr.exe Token: SeDebugPrivilege 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe 3872 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1332 Days Gone v1.0-v1.04 Plus 35 Trainer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Days Gone v1.0-v1.04 Plus 35 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Days Gone v1.0-v1.04 Plus 35 Trainer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3872
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\Days Gone v1.0-v1.04 Plus 35 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Days Gone v1.0-v1.04 Plus 35 Trainer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1332