Analysis
-
max time kernel
26s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 23:28
General
-
Target
022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03.exe
-
Size
55KB
-
MD5
0cfa58846e43dd67b6d9f29e97f6c53e
-
SHA1
19d9fbfd9b23d4bd435746a524443f1a962d42fa
-
SHA256
022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03
-
SHA512
263bb15955a86788d3006f4d3fdeabe6fed1291b6c6e60471ffdb59626755a81d1ffbafc58fe13c0633cb67f3f1d9a3ec92046b6d85eba56e56cd1c252ea4ea0
-
SSDEEP
1536:qzwshK8pUMGxo0xwwW9VemFMGfpbbVDzANyCa:wwshK8yMexbW9vJVDzANs
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3056 taskmgr.exe Token: SeSystemProfilePrivilege 3056 taskmgr.exe Token: SeCreateGlobalPrivilege 3056 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03.exe"C:\Users\Admin\AppData\Local\Temp\022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3240
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3056