Analysis
-
max time kernel
480s -
max time network
480s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
06-12-2024 10:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
9 signatures
300 seconds
General
-
Target
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
-
Size
1.5MB
-
MD5
aba2d86ed17f587eb6d57e6c75f64f05
-
SHA1
aeccba64f4dd19033ac2226b4445faac05c88b76
-
SHA256
807126cbae47c03c99590d081b82d5761e0b9c57a92736fc8516cf41bc564a7d
-
SHA512
c3f276820d6b2872c98fa36c7b62f236f9f2650b344a243a30dcda9ca08726f6ce27c5c380b4256a1a7d8d4309e1f2f270f10bad18099a8c9e1835925ea51806
-
SSDEEP
24576:pWKqa4hnzP3w7L3rmZmpk7FSQFW2iJ+N07/TwYV1CdZdQ+4lT+iFgiGTtswAtdz:pSrwf3aZmpOFU2iQNIUc1LxGTtswgd
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02ca4397da55b3175aaa1ad2c99981e792f66151.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02ca4397da55b3175aaa1ad2c99981e792f66151.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02ca4397da55b3175aaa1ad2c99981e792f66151.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02ca4397da55b3175aaa1ad2c99981e792f66151.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02ca4397da55b3175aaa1ad2c99981e792f66151.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02ca4397da55b3175aaa1ad2c99981e792f66151.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4308 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4308 taskmgr.exe Token: SeSystemProfilePrivilege 4308 taskmgr.exe Token: SeCreateGlobalPrivilege 4308 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"1⤵
- System Location Discovery: System Language Discovery
PID:692
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4308
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:520
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"1⤵
- System Location Discovery: System Language Discovery
PID:988
-
C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1192
-
C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1960
-
C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4896
-
C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"C:\Users\Admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2736