Resubmissions
04-12-2024 19:44
241204-yftswatlcj 1028-11-2024 19:40
241128-ydqnfaxqgy 1020-11-2024 16:31
241120-t1tw6azjfy 1020-11-2024 06:05
241120-gtdv5ssnes 1020-11-2024 06:00
241120-gqchxascje 1020-11-2024 05:52
241120-gk2kvaxkgn 1018-11-2024 21:54
241118-1sd93a1lfr 1017-11-2024 11:03
241117-m55qwsyemr 316-11-2024 19:06
241116-xsbmdssbkd 1016-11-2024 18:38
241116-w913ya1jcy 10Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
17-11-2024 11:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4363463463464363463463463.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
4363463463464363463463463.exe
-
Size
10KB
-
MD5
2a94f3960c58c6e70826495f76d00b85
-
SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
-
SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
-
SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
-
SSDEEP
192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4363463463464363463463463.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "102" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5744 4363463463464363463463463.exe Token: SeDebugPrivilege 1848 taskmgr.exe Token: SeSystemProfilePrivilege 1848 taskmgr.exe Token: SeCreateGlobalPrivilege 1848 taskmgr.exe Token: 33 1848 taskmgr.exe Token: SeIncBasePriorityPrivilege 1848 taskmgr.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe -
Suspicious use of SendNotifyMessage 51 IoCs
pid Process 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1652 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5744
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1848
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3360
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39d9855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1652