efa5e46131a9f87b24d67235a3bab0ea00bc6870f580a4d0da103252d4707eee

General

Target
1 (23).exe
Size 4.0MB
Sample201005-cvpj54ehhx
SHA256 efa5e46131a9f87b24d67235a3bab0ea00bc6870f580a4d0da103252d4707eee
MD5 e205b71ba88af817576a44c69fa19344
SHA1 1367928771225ee2d062bdbb2d6956dafab35baa
SHA512 3c88cbbd29d21354c1c3930d183512741b36310378053199ae9e7f63cb6688a500ae3e691c693eed03ea0744b3cf4be80881e83f2da6a3a76780852cb32f3789
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
4072	jacqieqs.exe
3696	jacqieqs.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	1 (23).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	1 (23).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	1 (23).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	1 (23).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	1 (23).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	1 (23).exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 3628	496	1 (23).exe	75
PID 496 wrote to memory of 3628	496	1 (23).exe	75
PID 496 wrote to memory of 3628	496	1 (23).exe	75
PID 496 wrote to memory of 4072	496	1 (23).exe	76
PID 496 wrote to memory of 4072	496	1 (23).exe	76
PID 496 wrote to memory of 4072	496	1 (23).exe	76
PID 496 wrote to memory of 1460	496	1 (23).exe	77
PID 496 wrote to memory of 1460	496	1 (23).exe	77
PID 496 wrote to memory of 1460	496	1 (23).exe	77
PID 4072 wrote to memory of 3696	4072	jacqieqs.exe	79
PID 4072 wrote to memory of 3696	4072	jacqieqs.exe	79
PID 4072 wrote to memory of 3696	4072	jacqieqs.exe	79

C:\Users\Admin\AppData\Local\Temp\1 (23).exe
"C:\Users\Admin\AppData\Local\Temp\1 (23).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:496
- C:\Users\Admin\AppData\Local\Temp\1 (23).exe
  "C:\Users\Admin\AppData\Local\Temp\1 (23).exe" /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Users\Admin\AppData\Roaming\Microsoft\Qvyeriqo\jacqieqs.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Qvyeriqo\jacqieqs.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Users\Admin\AppData\Roaming\Microsoft\Qvyeriqo\jacqieqs.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Qvyeriqo\jacqieqs.exe /C
    3⤵
    - Executes dropped EXE
    PID:3696
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xfatwztql /tr "\"C:\Users\Admin\AppData\Local\Temp\1 (23).exe\" /I xfatwztql" /SC ONCE /Z /ST 10:12 /ET 10:24
  2⤵
  - Creates scheduled task(s)
  PID:1460