Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 17:30
Behavioral task
behavioral1
Sample
sysfgdrvs.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
General
-
Target
sysfgdrvs.exe
-
Size
76KB
-
MD5
5db9a00364b3c87e0bc4c52d3fbda13d
-
SHA1
f2e1f784019db62dd2866295499650a2a7d629dd
-
SHA256
39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3
-
SHA512
7b472c384b011b24c8d4b0c7b67cc08f9708fee30bcbc38c93188064d1795ba581177cfbdd2f03d5a6f07c7ea4251c934f67710ade09ab04e9cb3884db94ef70
-
SSDEEP
1536:e3Mz8WzKcG6EBACCUDqgorWZK+DldD5Fw0F36:lwWWB0Aqg6WPpdD5Fwc6
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysfgdrvs.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysfgdrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysfgdrvs.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysfgdrvs.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 456 taskmgr.exe Token: SeSystemProfilePrivilege 456 taskmgr.exe Token: SeCreateGlobalPrivilege 456 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe 456 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sysfgdrvs.exe"C:\Users\Admin\AppData\Local\Temp\sysfgdrvs.exe"1⤵
- Windows security bypass
- Windows security modification
- System Location Discovery: System Language Discovery
PID:4644
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:456