Resubmissions
15-02-2025 17:48
250215-wdrvdswkfp 1015-02-2025 17:45
250215-wbsnxawnav 1014-02-2025 17:46
250214-wcq7gawkgz 1006-02-2025 16:53
250206-vec7yssnfk 10Analysis
-
max time kernel
69s -
max time network
73s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
20-02-2025 17:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SidMeiersCivilizationVII.zip
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Sid Meier's Civilization VII.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
16 signatures
150 seconds
General
-
Target
SidMeiersCivilizationVII.zip
-
Size
5.8MB
-
MD5
d84b0909926f1ae80215205ce8e9dcaa
-
SHA1
4c8bcba9c2c3568e1c3e4a42c8d698eabbd16c1a
-
SHA256
f3905d96e06b535e4b58082209a4fe220eab15a817039da2eddb648b5a20a75e
-
SHA512
3a124b6e36689024d217df1f79cbc68e1dc8c793441f51dc40f39f5e3a9fa3e9626c5392532b2e2d22fbcba09131dfcd11c59e17fde6956bb08a7134d0d193c2
-
SSDEEP
98304:tGO29oJD1+wov+AXvaYc5dIDZpkJBBM2Ib6w3eWXVY1Xp5frCKpR+cG:tE9ofvs+PYciG+2mvJUrfFpR0
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2500 taskmgr.exe Token: SeSystemProfilePrivilege 2500 taskmgr.exe Token: SeCreateGlobalPrivilege 2500 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SidMeiersCivilizationVII.zip1⤵PID:6000
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2500