Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-11-2024 22:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe
-
Size
1.4MB
-
MD5
586e8a1303aa1a9d794805cef724d5e3
-
SHA1
5fc2b1e53cbd130020ebc2404eb6d38f869cf680
-
SHA256
e43436adb5e9a765e5d30ef2dc7bf1b57037cda02b66f3dcc83520aad5bf82f2
-
SHA512
dbee6e66c7750032360b24dd6308835d74eea7c3c033e181f6b800a39cf50f0323df4ac9b62777476a6b0f0322a4285124338ce61bf6fc2e3bbe41bdcae84ed0
-
SSDEEP
24576:ekE0ODVXcJ/lX3DlX7xTbv1qW00NU1JdGU+wq0Dmr+to8lpb:jkJcJB37Tbv1q10NcqHwhPtlp
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2968 set thread context of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1224 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe Token: SeDebugPrivilege 1224 taskmgr.exe Token: SeSystemProfilePrivilege 1224 taskmgr.exe Token: SeCreateGlobalPrivilege 1224 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103 PID 2968 wrote to memory of 4068 2968 E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe"C:\Users\Admin\AppData\Local\Temp\E43436ADB5E9A765E5D30EF2DC7BF1B57037CDA02B66F3DCC83520AAD5BF82F2.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- System Location Discovery: System Language Discovery
PID:4068
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1224