Resubmissions
21-09-2024 01:58
240921-cdy4xszdnb 1021-09-2024 01:55
240921-cb94eazdql 1021-09-2024 01:54
240921-cbs5wszcrc 1020-09-2024 22:19
240920-18ynms1gln 10Analysis
-
max time kernel
1199s -
max time network
1133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
download.ps1
Resource
win7-20240729-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral2
Sample
download.ps1
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
1200 seconds
General
-
Target
download.ps1
-
Size
222B
-
MD5
4225b2ad70add8281a8d8ac6e1c5d9da
-
SHA1
85bb57d35c69a159849b694b80618f1de6b8633c
-
SHA256
10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31f
-
SHA512
412d63aaf85d2ba0c48bd9513484731d84f83b231b8b0ac88de102c54e06e5a126e2a0ea1c266849b369e2084d4f37624d899ea420e771a17fc14227ee56b4a6
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 7 4696 powershell.exe -
pid Process 4696 powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4696 powershell.exe 4696 powershell.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3840 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4696 powershell.exe Token: SeDebugPrivilege 3840 taskmgr.exe Token: SeSystemProfilePrivilege 3840 taskmgr.exe Token: SeCreateGlobalPrivilege 3840 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe 3840 taskmgr.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\download.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82