Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows11-21h2_x64 -
resource
win11-20250210-en -
resource tags
arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-02-2025 16:25
Static task
static1
Behavioral task
behavioral1
Sample
42.zip
Resource
win11-20250210-en
General
-
Target
42.zip
-
Size
41KB
-
MD5
1df9a18b18332f153918030b7b516615
-
SHA1
6c42c62696616b72bbfc88a4be4ead57aa7bc503
-
SHA256
bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
-
SHA512
6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
-
SSDEEP
768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
flow pid Process 16 4724 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1000 MicrosoftEdgeUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Taskmgr.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2016127986-2399012302-1384646033-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2016127986-2399012302-1384646033-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-2016127986-2399012302-1384646033-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-2016127986-2399012302-1384646033-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2016127986-2399012302-1384646033-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask Taskmgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2016127986-2399012302-1384646033-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2168 Taskmgr.exe Token: SeSystemProfilePrivilege 2168 Taskmgr.exe Token: SeCreateGlobalPrivilege 2168 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe 2168 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2600 MiniSearchHost.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\42.zip1⤵PID:2908
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:5092
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:916
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0MwRDUwNzEtRjY4RS00QjE3LUE5ODUtRTJDQjVGODkxRjc1fSIgdXNlcmlkPSJ7RTQwNDI4NjItQzFEOC00Qzg0LThCNkYtREQ2RDI0NDNBM0I3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7REJCOTM0NzMtNTA0Mi00OUNCLUI1RkMtQkVCQkU5OTU2QkY5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjciIGluc3RhbGxkYXRldGltZT0iMTczOTE4MzgwMSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NTYyMTc0MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMzE2NTEyMDkiLz48L2FwcD48L3JlcXVlc3Q-1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1000
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2600
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\d434fe99-63e4-4a57-bfdb-84c8d45f5872.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize25KB
MD51abd1e317ff96d9e4febed225ffba66c
SHA11e14f4a4d025f8a319bafd4ffeaad054c5c12806
SHA256981900d19ee7008b98cb9268e0ec359017ff524e0830ea28daa02b02ca094a52
SHA5124f86fc984f67122a1c25954e57b3fc44051bee692e155069419f56c0533fd0137de3dc1f096cad8c0089b814cfaadfba1a236c4cef0fcb17fd910292d982d1f2