Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 03:58
Behavioral task
behavioral1
Sample
svClient.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
svClient.exe
-
Size
23KB
-
MD5
ff1cdc6cc1dd1811ba8bcfe8ff959248
-
SHA1
3079eef789f30dba934bb732424a68410759e8b6
-
SHA256
5df04e479ea8af49820ccd533240a0ee750bb6dcce6ca864f2e3bcd0c03104ff
-
SHA512
686dc368f3c18e756d67231163547944f68efa2cb37e66470f8762ba0ca13c27d4130fe984418c14743d45bcd7e8256c57ddd0d9d050793111b170c8151da04f
-
SSDEEP
384:L0jeCIYTNQZUuQnJXJeCXlwhPQ6DgDOwBHhdmRvR6JZlbw8hqIusZzZttuJy:Y3jNAU/ZVXMRpcnuquQ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1836 4840 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svClient.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2152 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2152 taskmgr.exe Token: SeSystemProfilePrivilege 2152 taskmgr.exe Token: SeCreateGlobalPrivilege 2152 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe 2152 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\svClient.exe"C:\Users\Admin\AppData\Local\Temp\svClient.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 4482⤵
- Program crash
PID:1836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4840 -ip 48401⤵PID:2128
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2152