Resubmissions
12-12-2024 01:56
241212-cc56vawncv 1018-11-2024 13:48
241118-q4ed4ayarj 1015-11-2024 01:42
241115-b4vnrawgnb 1015-11-2024 01:41
241115-b4c4pswkbz 1009-11-2024 01:42
241109-b4st6avbme 10Analysis
-
max time kernel
30s -
max time network
36s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-11-2024 01:42
Static task
static1
ratminermodiloadernetfilternetwiresnakekeyloggerzeppelincobaltstrikehellokittymassloggermerlinmountlockerxmriggcleanerremcos
24 signatures
Behavioral task
behavioral1
Sample
eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df10
Resource
win11-20241023-en
windows11-21h2-x64
7 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df10
-
Size
18.5MB
-
MD5
bd4dfea472d4fa0e9550f739bd8d04d3
-
SHA1
c462a46f0ab1243ae616ccb03839e7f90b993315
-
SHA256
eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df10
-
SHA512
940cd64aaf9c476fed8d2031db2edc8f626be244ab4f78f392d0e608f93796fdc2d87b0ddd20ec2db0ec29c008f536192da65d2bb31442f34c73142fc3b26e20
-
SSDEEP
196608:6dZItlOME4gqh+r4R6N8Gb0VKgt0JjLIP6BxP6LOfXAkZ:IJ
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "65" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 336 taskmgr.exe Token: SeSystemProfilePrivilege 336 taskmgr.exe Token: SeCreateGlobalPrivilege 336 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe 336 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1632 LogonUI.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df101⤵PID:4908
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:336
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39c1855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1632