Analysis
-
max time kernel
369s -
max time network
219s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-es -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250128-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows -
submitted
28/01/2025, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
bad_boi.exe
Resource
win7-20241023-es
windows7-x64
22 signatures
300 seconds
Behavioral task
behavioral2
Sample
bad_boi.exe
Resource
win10ltsc2021-20250128-es
windows10-ltsc 2021-x64
9 signatures
300 seconds
General
-
Target
bad_boi.exe
-
Size
376KB
-
MD5
7d3f19b760cb1958a2c4d9ca7492c406
-
SHA1
c3fa91438850c88c81c0712204a273e382d8fa7b
-
SHA256
f8bc1638ec3b04412f708233e8586e1d91f18f6715d68cba1a491d4a7f457da0
-
SHA512
64d14a7a3866c76d45bea7bee19d40f63241c777d8d259a8a79279cac51396fe9469f28fc68eaa8ab688af13a47c4c5af0d62005d93a4649f81e411b8f2eae91
-
SSDEEP
6144:jwHqh+1uu3RVmPY55eExdAev5wuSiRqAO1iNgLTBs4LhVJqRcelLQMo8:P+1uu3RVmPYaad5wuSiRqLNeRcZMo8
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bad_boi.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2116 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2116 taskmgr.exe Token: SeSystemProfilePrivilege 2116 taskmgr.exe Token: SeCreateGlobalPrivilege 2116 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bad_boi.exe"C:\Users\Admin\AppData\Local\Temp\bad_boi.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4648
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2116
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3660