Analysis
-
max time kernel
90s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2025, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
C7CA98803A76B62A6A379A0B684B162A.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
900 seconds
General
-
Target
C7CA98803A76B62A6A379A0B684B162A.exe
-
Size
9.3MB
-
MD5
c7ca98803a76b62a6a379a0b684b162a
-
SHA1
00de8f4666fe890f9fd3bf2d405cae32f3c2cc78
-
SHA256
7fff867271d6f0f7c301e83dad5875e2194dbf2389ac33130b7711db7e6904bd
-
SHA512
e9cf5fb9efd723fd404c10b3451ae6f22a8582041cd97292d09d43baaeb93f0d2f38f40cd9c1927221f8ad746b01490727c853b9a123fc4b34b6ce6ba557fb7b
-
SSDEEP
24576:UYCZttSeaoP5LJSkOQv2pjXhFoEQPx4IERmTs6ICUZKVBkPHXNj24:UYCftdbPXSbm2CUZKVBkPHXNjf
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7CA98803A76B62A6A379A0B684B162A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7CA98803A76B62A6A379A0B684B162A.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1812 taskmgr.exe Token: SeSystemProfilePrivilege 1812 taskmgr.exe Token: SeCreateGlobalPrivilege 1812 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\C7CA98803A76B62A6A379A0B684B162A.exe"C:\Users\Admin\AppData\Local\Temp\C7CA98803A76B62A6A379A0B684B162A.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3532
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1520
-
C:\Users\Admin\Desktop\C7CA98803A76B62A6A379A0B684B162A.exe"C:\Users\Admin\Desktop\C7CA98803A76B62A6A379A0B684B162A.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1220
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.2MB
MD5f6d8913637f1d5d2dc846de70ce02dc5
SHA15fc9c6ab334db1f875fbc59a03f5506c478c6c3e
SHA2564e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187
SHA51221217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036