Analysis
-
max time kernel
55s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 20:43
General
-
Target
randomfile.exe
-
Size
210KB
-
MD5
004d0d489f1547b76aa91465a2dbc99f
-
SHA1
c767780d3a0bf1edeead92605ce849a78f3041b6
-
SHA256
d09b1d9588c03e806ed27e7fe6bee63af7da8d332e719e5dc4579278722e6e99
-
SHA512
07a90505965d89f9af718d7b15741b5064766dbf599219528ff1c59e70f99338904273f931b25728ead3dc65de41c8ed9cf43b18cca58d62bfc7b856d6cf9ccc
-
SSDEEP
6144:wLV6Bta6dtJmakIM5j100ody3ydprVaaQE:wLV6Btpmk+G0l3faQE
Malware Config
Signatures
-
Processes:
randomfile.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA randomfile.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
randomfile.exetaskmgr.exepid process 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe 4492 taskmgr.exe 4492 taskmgr.exe 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe 2304 randomfile.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
randomfile.exepid process 2304 randomfile.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
randomfile.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2304 randomfile.exe Token: SeDebugPrivilege 4492 taskmgr.exe Token: SeSystemProfilePrivilege 4492 taskmgr.exe Token: SeCreateGlobalPrivilege 4492 taskmgr.exe Token: 33 4492 taskmgr.exe Token: SeIncBasePriorityPrivilege 4492 taskmgr.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
Processes:
taskmgr.exepid process 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
Processes:
taskmgr.exepid process 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
randomfile.exedescription pid process target process PID 2304 wrote to memory of 1764 2304 randomfile.exe schtasks.exe PID 2304 wrote to memory of 1764 2304 randomfile.exe schtasks.exe PID 2304 wrote to memory of 1764 2304 randomfile.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\randomfile.exe"C:\Users\Admin\AppData\Local\Temp\randomfile.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5CA2.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5CA2.tmpFilesize
1KB
MD55988267d30e4536e048a71ebf6ce2287
SHA1908ffb7e1ede3b4861251acc3111b13d7673cc03
SHA25620a81a8b3d82762db94c240a16c3a0728370dae1bbee6ab98339aac706002ed1
SHA512dea6b7c07570437197758a1b37710689d77a4b358f5bc39515cb7ace44590c2a58767708f8cac1570e1d0c808dcc48ecdd905809772b891ee9ce27ceba866748
-
memory/2304-0-0x00000000750F2000-0x00000000750F3000-memory.dmpFilesize
4KB
-
memory/2304-1-0x00000000750F0000-0x00000000756A1000-memory.dmpFilesize
5.7MB
-
memory/2304-2-0x00000000750F0000-0x00000000756A1000-memory.dmpFilesize
5.7MB
-
memory/2304-7-0x00000000750F0000-0x00000000756A1000-memory.dmpFilesize
5.7MB
-
memory/2304-8-0x00000000750F2000-0x00000000750F3000-memory.dmpFilesize
4KB
-
memory/2304-9-0x00000000750F0000-0x00000000756A1000-memory.dmpFilesize
5.7MB
-
memory/2304-23-0x00000000750F0000-0x00000000756A1000-memory.dmpFilesize
5.7MB
-
memory/4492-11-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB
-
memory/4492-10-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB
-
memory/4492-22-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB
-
memory/4492-21-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB
-
memory/4492-20-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB
-
memory/4492-19-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB
-
memory/4492-18-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB
-
memory/4492-17-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB
-
memory/4492-16-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB
-
memory/4492-12-0x0000025E233E0000-0x0000025E233E1000-memory.dmpFilesize
4KB