589a1bf653a1dd57b62f42471df6b1a39a46a76ed0c7fbbdc73a70588d4c3c0f

General

Target
1 (8).exe
Size 4.0MB
Sample201005-gd4r2etap6
SHA256 589a1bf653a1dd57b62f42471df6b1a39a46a76ed0c7fbbdc73a70588d4c3c0f
MD5 e23033adc6e6cf7f03a996b1f83a6da0
SHA1 4b79aaa953b8c99672792dd7f78270002a4378b9
SHA512 591c76504d962f32a36e0eb51a445ab5a2d7402a6f8a089beddf506f79944aeb6fb74ea3cc94ab07d89d9839bd2490cf1daba954125124d392e230ac33c62456
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
728	uboahcjs.exe
3128	uboahcjs.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	1 (8).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	1 (8).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	1 (8).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	1 (8).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	1 (8).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	1 (8).exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3016	2080	1 (8).exe	75
PID 2080 wrote to memory of 3016	2080	1 (8).exe	75
PID 2080 wrote to memory of 3016	2080	1 (8).exe	75
PID 2080 wrote to memory of 728	2080	1 (8).exe	76
PID 2080 wrote to memory of 728	2080	1 (8).exe	76
PID 2080 wrote to memory of 728	2080	1 (8).exe	76
PID 2080 wrote to memory of 3812	2080	1 (8).exe	77
PID 2080 wrote to memory of 3812	2080	1 (8).exe	77
PID 2080 wrote to memory of 3812	2080	1 (8).exe	77
PID 728 wrote to memory of 3128	728	uboahcjs.exe	79
PID 728 wrote to memory of 3128	728	uboahcjs.exe	79
PID 728 wrote to memory of 3128	728	uboahcjs.exe	79

C:\Users\Admin\AppData\Local\Temp\1 (8).exe
"C:\Users\Admin\AppData\Local\Temp\1 (8).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\1 (8).exe
  "C:\Users\Admin\AppData\Local\Temp\1 (8).exe" /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Users\Admin\AppData\Roaming\Microsoft\Frmlvugi\uboahcjs.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Frmlvugi\uboahcjs.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Users\Admin\AppData\Roaming\Microsoft\Frmlvugi\uboahcjs.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Frmlvugi\uboahcjs.exe /C
    3⤵
    - Executes dropped EXE
    PID:3128
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sjkrrcnoy /tr "\"C:\Users\Admin\AppData\Local\Temp\1 (8).exe\" /I sjkrrcnoy" /SC ONCE /Z /ST 10:11 /ET 10:23
  2⤵
  - Creates scheduled task(s)
  PID:3812