Analysis
-
max time kernel
136s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
30/03/2025, 04:24
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
test.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
test.exe
-
Size
164KB
-
MD5
2369fa6bdd5e97a7dcd2aea9d7f39dca
-
SHA1
f1cdfc5fffaa82131c2f5c881de155e37dcfc469
-
SHA256
a4ba4c1c540627c04f01f592c422996497c8ab882a4329d297de11289667ebb1
-
SHA512
a4705fef7da26a96547685e61524b2b742be9daeb282bdebbc16c48a4b22dc0796f95211737b28b33abe5de4bdf82664c9811b3889e035ef54d0e072dca25cb2
-
SSDEEP
3072:PbyC/42vwqdUEBCVbFFtsJH4jyrbNeUCNo6wv1mo:PbBubFFthjKbe4P
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe -
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe -
Kills process with taskkill 8 IoCs
pid Process 1356 TASKKILL.exe 3268 TASKKILL.exe 928 TASKKILL.exe 1880 TASKKILL.exe 948 TASKKILL.exe 3468 TASKKILL.exe 2568 TASKKILL.exe 3688 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 856 schtasks.exe 1444 schtasks.exe 4492 schtasks.exe 220 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 776 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 4680 test.exe 2228 test.exe 2228 test.exe 2228 test.exe 2228 test.exe 2228 test.exe 2228 test.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 776 test.exe Token: SeDebugPrivilege 3688 TASKKILL.exe Token: SeDebugPrivilege 2568 TASKKILL.exe Token: SeDebugPrivilege 4680 test.exe Token: SeDebugPrivilege 3268 TASKKILL.exe Token: SeDebugPrivilege 1356 TASKKILL.exe Token: SeRestorePrivilege 5612 dw20.exe Token: SeBackupPrivilege 5612 dw20.exe Token: SeBackupPrivilege 5612 dw20.exe Token: SeBackupPrivilege 5612 dw20.exe Token: SeBackupPrivilege 5612 dw20.exe Token: SeBackupPrivilege 4124 dw20.exe Token: SeBackupPrivilege 4124 dw20.exe Token: SeDebugPrivilege 2228 test.exe Token: SeDebugPrivilege 928 TASKKILL.exe Token: SeDebugPrivilege 1880 TASKKILL.exe Token: SeBackupPrivilege 2460 dw20.exe Token: SeBackupPrivilege 2460 dw20.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 776 wrote to memory of 2568 776 test.exe 90 PID 776 wrote to memory of 2568 776 test.exe 90 PID 776 wrote to memory of 2568 776 test.exe 90 PID 776 wrote to memory of 3688 776 test.exe 91 PID 776 wrote to memory of 3688 776 test.exe 91 PID 776 wrote to memory of 3688 776 test.exe 91 PID 776 wrote to memory of 5524 776 test.exe 102 PID 776 wrote to memory of 5524 776 test.exe 102 PID 776 wrote to memory of 5524 776 test.exe 102 PID 776 wrote to memory of 1444 776 test.exe 104 PID 776 wrote to memory of 1444 776 test.exe 104 PID 776 wrote to memory of 1444 776 test.exe 104 PID 4680 wrote to memory of 3268 4680 test.exe 107 PID 4680 wrote to memory of 3268 4680 test.exe 107 PID 4680 wrote to memory of 3268 4680 test.exe 107 PID 4680 wrote to memory of 1356 4680 test.exe 108 PID 4680 wrote to memory of 1356 4680 test.exe 108 PID 4680 wrote to memory of 1356 4680 test.exe 108 PID 776 wrote to memory of 5612 776 test.exe 111 PID 776 wrote to memory of 5612 776 test.exe 111 PID 776 wrote to memory of 5612 776 test.exe 111 PID 4680 wrote to memory of 4504 4680 test.exe 114 PID 4680 wrote to memory of 4504 4680 test.exe 114 PID 4680 wrote to memory of 4504 4680 test.exe 114 PID 4680 wrote to memory of 4492 4680 test.exe 116 PID 4680 wrote to memory of 4492 4680 test.exe 116 PID 4680 wrote to memory of 4492 4680 test.exe 116 PID 4680 wrote to memory of 4124 4680 test.exe 122 PID 4680 wrote to memory of 4124 4680 test.exe 122 PID 4680 wrote to memory of 4124 4680 test.exe 122 PID 2228 wrote to memory of 1880 2228 test.exe 129 PID 2228 wrote to memory of 1880 2228 test.exe 129 PID 2228 wrote to memory of 1880 2228 test.exe 129 PID 2228 wrote to memory of 928 2228 test.exe 130 PID 2228 wrote to memory of 928 2228 test.exe 130 PID 2228 wrote to memory of 928 2228 test.exe 130 PID 2228 wrote to memory of 1480 2228 test.exe 133 PID 2228 wrote to memory of 1480 2228 test.exe 133 PID 2228 wrote to memory of 1480 2228 test.exe 133 PID 2228 wrote to memory of 220 2228 test.exe 135 PID 2228 wrote to memory of 220 2228 test.exe 135 PID 2228 wrote to memory of 220 2228 test.exe 135 PID 2228 wrote to memory of 2460 2228 test.exe 137 PID 2228 wrote to memory of 2460 2228 test.exe 137 PID 2228 wrote to memory of 2460 2228 test.exe 137
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:5524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\test.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1444
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 15522⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5612
-
-
C:\Users\Admin\AppData\Local\Temp\test.exeC:\Users\Admin\AppData\Local\Temp\test.exe1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:4504
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\test.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4492
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9322⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Users\Admin\AppData\Local\Temp\test.exeC:\Users\Admin\AppData\Local\Temp\test.exe1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:1480
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\test.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:220
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9882⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Users\Admin\AppData\Local\Temp\test.exeC:\Users\Admin\AppData\Local\Temp\test.exe1⤵
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- Kills process with taskkill
PID:3468
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- Kills process with taskkill
PID:948
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵PID:3692
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\test.exe" /sc minute /mo 12⤵
- Scheduled Task/Job: Scheduled Task
PID:856
-