Analysis
-
max time kernel
20s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12-10-2024 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NL Hybrid.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
150 seconds
General
-
Target
NL Hybrid.exe
-
Size
161KB
-
MD5
21c4a3300721338904a0f205e4a1ab3b
-
SHA1
5d76cda0274c82b90f71bd356317f5654c07201a
-
SHA256
bdb307d8ba6a6851d320ce2127e07ee4fed51d58e3598bec8b2dc7c16139b8d8
-
SHA512
6a9919f673756e3854b825810df297733302d1c7749c12ff1d3207916e0f970ceeb9759ab3e22ce82f922d1c1657f2690c93db0fdfb2e6e963618eb3c8c7a1b8
-
SSDEEP
3072:U7LW6Pr46prwG2k5GlI1JWE9QVsxyvJyn4NTfQf1VZlhWhruNeQO:UXWJ5kICW3Jyn4if1VZfiuwQ
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2288 taskmgr.exe Token: SeSystemProfilePrivilege 2288 taskmgr.exe Token: SeCreateGlobalPrivilege 2288 taskmgr.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe -
Suspicious use of SendNotifyMessage 28 IoCs
pid Process 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe 2288 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NL Hybrid.exe"C:\Users\Admin\AppData\Local\Temp\NL Hybrid.exe"1⤵PID:4400
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2288
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4232
-
C:\Windows\System32\ksdydr.exe"C:\Windows\System32\ksdydr.exe"1⤵PID:4212