Analysis
-
max time kernel
102s -
max time network
112s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
15-01-2025 18:45
Behavioral task
behavioral1
Sample
New Client.exe
Resource
win10ltsc2021-20250113-en
windows10-ltsc 2021-x64
10 signatures
150 seconds
General
-
Target
New Client.exe
-
Size
166KB
-
MD5
567034dbacd78e0cfc0c13cb0d9e5ba1
-
SHA1
3502ca8d7f37858e559e382f0d0fc55ed46e5712
-
SHA256
2da9da3229c3be8e95ad3c09bb4c20180df52965c46c136425d3f4c65b2136bf
-
SHA512
5c6eee3362e0fb241589964cca936f644ec5abe934ab40765f648b9481c30a9e70cad495c94b6cc6f2cfc51bed0827c0d0664e33efe567e4c1743bbdf1cb0696
-
SSDEEP
3072:tWfc8/uCrBpUXCVNJvDet351XQqY6fAuOEyn+Srb7xSRdnEYUf:0fJVTDet353dUb4PEY
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4508 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 2960 dw20.exe Token: SeBackupPrivilege 2960 dw20.exe Token: SeBackupPrivilege 2960 dw20.exe Token: SeBackupPrivilege 2960 dw20.exe Token: SeDebugPrivilege 3328 taskmgr.exe Token: SeSystemProfilePrivilege 3328 taskmgr.exe Token: SeCreateGlobalPrivilege 3328 taskmgr.exe Token: 33 3328 taskmgr.exe Token: SeIncBasePriorityPrivilege 3328 taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 928 wrote to memory of 748 928 New Client.exe 83 PID 928 wrote to memory of 748 928 New Client.exe 83 PID 928 wrote to memory of 748 928 New Client.exe 83 PID 928 wrote to memory of 4508 928 New Client.exe 86 PID 928 wrote to memory of 4508 928 New Client.exe 86 PID 928 wrote to memory of 4508 928 New Client.exe 86 PID 928 wrote to memory of 2960 928 New Client.exe 88 PID 928 wrote to memory of 2960 928 New Client.exe 88 PID 928 wrote to memory of 2960 928 New Client.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:748
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4508
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9442⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3328