Analysis
-
max time kernel
374s -
max time network
363s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-09-2024 09:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a85283c2324e2edca848e2aebec2067be80e7215d554b9d76598973e9d587aa6.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
600 seconds
Behavioral task
behavioral2
Sample
a85283c2324e2edca848e2aebec2067be80e7215d554b9d76598973e9d587aa6.exe
Resource
win11-20240802-en
windows11-21h2-x64
9 signatures
600 seconds
General
-
Target
a85283c2324e2edca848e2aebec2067be80e7215d554b9d76598973e9d587aa6.exe
-
Size
40KB
-
MD5
017831928f431423db720ede2c499be7
-
SHA1
5cec6722b5ae7f976447a69bf106e1789af22795
-
SHA256
a85283c2324e2edca848e2aebec2067be80e7215d554b9d76598973e9d587aa6
-
SHA512
47569e8685ebd8f7d5994ab99b74302bb1cec84db0edde430026797bd0fd3c668a223d8efd2573cdf3ad0a06d5effc65f265a5b20eeafe246ed8f5ad271c1963
-
SSDEEP
192:4EjUU1VnazK2wLB53uutB6zgJEX3qjivYuoND5HHLVKMgXSwe1DunUe3Q5xymXU/:pnrazLw15b0bvY1EMEn38
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
C2
http://47.93.116.52:25678/Z9Tv
Attributes
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; Avant Browser)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3136 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3136 Taskmgr.exe Token: SeSystemProfilePrivilege 3136 Taskmgr.exe Token: SeCreateGlobalPrivilege 3136 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe 3136 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2716 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a85283c2324e2edca848e2aebec2067be80e7215d554b9d76598973e9d587aa6.exe"C:\Users\Admin\AppData\Local\Temp\a85283c2324e2edca848e2aebec2067be80e7215d554b9d76598973e9d587aa6.exe"1⤵PID:2544
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2716
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3412
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3136
-
C:\Users\Admin\AppData\Local\Temp\a85283c2324e2edca848e2aebec2067be80e7215d554b9d76598973e9d587aa6.exe"C:\Users\Admin\AppData\Local\Temp\a85283c2324e2edca848e2aebec2067be80e7215d554b9d76598973e9d587aa6.exe"1⤵PID:2216