Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe
-
Size
680KB
-
MD5
de14f5adcd20b19b6b221647507c7c09
-
SHA1
74a3dad2deeffa26a21f643273089847df606f3f
-
SHA256
ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923
-
SHA512
72f3950a43bac271ddd9290bfcbf4d26072abb584f9d643d90b0a98ae2e05da2649b193336d826412f8b130fd1854d76ffba9c4464f9993640154e97e4cc12c3
-
SSDEEP
12288:PWvWgQsk97ZQjoOi1dkxVU6S8HWK/a1KPesnWwNnuFBbSEWEEEHnmfY5JdutJRMf:4v7k7ii1yUiH0
Score
10/10
Malware Config
Signatures
-
Imminent family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bot = "\\bot\\bot.exe" ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bot = "C:\\Users\\Admin\\AppData\\Roaming\\bot\\bot.exe" ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 4700 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe Token: 33 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe Token: SeIncBasePriorityPrivilege 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe Token: SeDebugPrivilege 4700 Taskmgr.exe Token: SeSystemProfilePrivilege 4700 Taskmgr.exe Token: SeCreateGlobalPrivilege 4700 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe 4700 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4700 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 84 PID 4800 wrote to memory of 4700 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 84 PID 4800 wrote to memory of 4700 4800 ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe"C:\Users\Admin\AppData\Local\Temp\ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4700
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42B
MD5abd0f6e13501f347e54ae6060f0e61eb
SHA1f94cacf144b2c1f798667eb85dca532f6746d4a7
SHA2567f9e5bed5bb2b25e2c0d9b235005df5fa388650f47c1c9743e0d226bc4dcb615
SHA5124786455d7ea5b3508027bcbdf4e5e278e3fc90bb162ff6714256e53b9ac971b3e7a128d1040e15cd8eeb8e4fb4d60d1a1383bee0371b721d35c6425bd6d8f7e4