Analysis
-
max time kernel
383s -
max time network
345s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-de -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-delocale:de-deos:windows10-ltsc 2021-x64systemwindows -
submitted
15-01-2025 12:34
Behavioral task
behavioral1
Sample
REMAINING_TANK-TOP.exe
Resource
win10ltsc2021-20250113-de
windows10-ltsc 2021-x64
9 signatures
300 seconds
General
-
Target
REMAINING_TANK-TOP.exe
-
Size
16.4MB
-
MD5
a88b2cff77f57eb0489b10cf889ad1b0
-
SHA1
e2f1907ce60ce17e79d60d4c94777ea260658484
-
SHA256
0fe4236f57b3388bb36c35e97c64459f3d7df36ca96f48a3e812a58ffa2be400
-
SHA512
cb75bcff906c5afee1405efb8b066eacd23344ddec840047fcc65cbfb01dc2d11b52f0806a66713d11b5d43b90d0f7623c7bd17abce5574dc31bbaca491c71da
-
SSDEEP
98304:r34KgzzVkQhO0oo97gOyX5XWM/g0/lIV+Ozy5jaEy8139XfEg:j2DKOyX5X9/g0/lIV+Ozy5jHHfEg
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4980 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4980 taskmgr.exe Token: SeSystemProfilePrivilege 4980 taskmgr.exe Token: SeCreateGlobalPrivilege 4980 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1920 OpenWith.exe 1920 OpenWith.exe 1920 OpenWith.exe 1920 OpenWith.exe 1920 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1920 wrote to memory of 4000 1920 OpenWith.exe 105 PID 1920 wrote to memory of 4000 1920 OpenWith.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\REMAINING_TANK-TOP.exe"C:\Users\Admin\AppData\Local\Temp\REMAINING_TANK-TOP.exe"1⤵PID:3696
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4980
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1700
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\REMAINING_TANK-TOP.DMP2⤵PID:4000
-