Analysis
-
max time kernel
243s -
max time network
210s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
27/01/2025, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
#Pa$$CŌ𝔻e--8166__OpeN-Se-tUp@!#.zip
Resource
win10ltsc2021-20250113-en
windows10-ltsc 2021-x64
8 signatures
600 seconds
Behavioral task
behavioral2
Sample
#P@S$wǾr𝓓__8166--Se-tUp@!.7z
Resource
win10ltsc2021-20250113-en
windows10-ltsc 2021-x64
8 signatures
600 seconds
Behavioral task
behavioral3
Sample
!Premium--SatUp/setup.exe
Resource
win10ltsc2021-20250113-en
windows10-ltsc 2021-x64
5 signatures
600 seconds
Behavioral task
behavioral4
Sample
Pa$S_-_8166.txt
Resource
win10ltsc2021-20250113-en
windows10-ltsc 2021-x64
0 signatures
600 seconds
General
-
Target
#Pa$$CŌ𝔻e--8166__OpeN-Se-tUp@!#.zip
-
Size
2.5MB
-
MD5
6c0ca3b86a0c9dadd1c781f06b8454d6
-
SHA1
f9fc36d10f574e3cd53a779b826ae4fe58b67b55
-
SHA256
2769011676e1338034dcee815050efd37055966968ed7e1114a5f85be9bb6b62
-
SHA512
347dd172e556e118260be30d8da9daca1f637a2c033320ba3b21be4b15aed811b99499bec7364cdf63e7937450312b9c226088175d09cfa624e05715383b7a17
-
SSDEEP
12288:K6lXoAow3jU6PA0CRAZOzIl67TC3/A4j18y0wDhjx9kuagdPLmVEc9PFityFdc:ff33AyaI07+vjOy0w0gxGEcnitAc
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1060 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1060 taskmgr.exe Token: SeSystemProfilePrivilege 1060 taskmgr.exe Token: SeCreateGlobalPrivilege 1060 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\#Pa$$CŌ𝔻e--8166__OpeN-Se-tUp@!#.zip1⤵PID:456
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1060
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:3780
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:4964