Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 13:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Client_xyeta.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
Client_xyeta.exe
-
Size
537KB
-
MD5
9b2eaed309978e0b696eed9c4bf81862
-
SHA1
55ceaa228f214230731464c3f15c30fdb1226b90
-
SHA256
d28901684b199280d58d7d07b2a2428099f709afe4e37846f911527e2917dd53
-
SHA512
a1d098719e262774a73a6d4efeaa7bcd9d3cbd07fdaa42200414080122fa2c21cf219babc4c48beb03005df6f983cefc7ef2d71f3f09744fd1802a0c741b571c
-
SSDEEP
12288:WD3BvlZNKFGNoxHkjnbymWR2wr1rq8JY:Wdt8GKxonLy1rg
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 860 3600 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client_xyeta.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4472 taskmgr.exe Token: SeSystemProfilePrivilege 4472 taskmgr.exe Token: SeCreateGlobalPrivilege 4472 taskmgr.exe Token: 33 4472 taskmgr.exe Token: SeIncBasePriorityPrivilege 4472 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe 4472 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client_xyeta.exe"C:\Users\Admin\AppData\Local\Temp\Client_xyeta.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 8362⤵
- Program crash
PID:860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3600 -ip 36001⤵PID:4612
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4472
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1328