Analysis
-
max time kernel
213s -
max time network
204s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12-10-2024 06:27
Behavioral task
behavioral1
Sample
Client4PM..exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
Client4PM..exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
300 seconds
General
-
Target
Client4PM..exe
-
Size
16KB
-
MD5
78546805aa20d09136de689620dc6ca2
-
SHA1
3bfafdc380309d9ba9632d81ee220f063f6fe522
-
SHA256
f52dd2dd58a66fb26ff986cd9bd6b033d0bca73800606ba4f6e6033fa44bf023
-
SHA512
ef6210d14cec248d8361a5aa01f597853aad0305ebac68f51e00e73123e983a4bb502130a72e1a5fc910de1363a661caaa864f3f8ff06fd5d57728d9304f5ddc
-
SSDEEP
384:KLGXnSVdX5/VBji1D9oDPlMNcLlb5sVKZyz5Ct:KLGXnSVdTBjyclMNE4o
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri Taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri Taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 Client4PM..exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Client4PM..exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings Client4PM..exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4876 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4944 Client4PM..exe Token: SeDebugPrivilege 4876 Taskmgr.exe Token: SeSystemProfilePrivilege 4876 Taskmgr.exe Token: SeCreateGlobalPrivilege 4876 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe 4876 Taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4876 4944 Client4PM..exe 76 PID 4944 wrote to memory of 4876 4944 Client4PM..exe 76 PID 4944 wrote to memory of 1948 4944 Client4PM..exe 77 PID 4944 wrote to memory of 1948 4944 Client4PM..exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client4PM..exe"C:\Users\Admin\AppData\Local\Temp\Client4PM..exe"1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4876
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\atnxDpn.vbs"2⤵PID:1948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD5502b0b2bd2887a2a1dbd470b8ee92d9c
SHA17a3907f54b2f8b57be6072d28aff3f6174f8f010
SHA256a31b7d0b86764919634b44f2ceca8dda07981aa6a2a9a3f7050cf95e7b480807
SHA512bba93f39efab99a6aeedaa12a9c654477cd34204df1424222fe819ff82eb36511b7dccfc01b7b687e21cca101a37d88ef143d6aaf658e6a25b959cf5d3d5191e