f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b

General

Target
f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
Size 4.1MB
Sample201014-d549wnbn1a
SHA256 f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b
MD5 b60f1bea92f67a84cf0cf6b8030204f9
SHA1 1c856f5378f5c0a40e42349a9a71eb57eacb6678
SHA512 c9c8a50c2bf39cc948c1fbf03021cf639a3a23a0614b577e2aa903897dedd2ddbcab3b17b1d15b68a9920d3677b075c9b029726ea9abce999d7a7c8586659142
MD5 SHA1 SHA512

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\vldro = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Otrtomyuxzln\\tpryrja.exe\""	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2460	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
2460	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
1528	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
1528	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
1528	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
1528	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1528	2460	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	76
PID 2460 wrote to memory of 1528	2460	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	76
PID 2460 wrote to memory of 1528	2460	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	76
PID 2460 wrote to memory of 1796	2460	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	77
PID 2460 wrote to memory of 1796	2460	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	77
PID 2460 wrote to memory of 1796	2460	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	77

C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
"C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
  C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tasyprm /tr "\"C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe\" /I tasyprm" /SC ONCE /Z /ST 07:20 /ET 07:32
  2⤵
  - Creates scheduled task(s)
  PID:1796

C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe /I tasyprm
1⤵
PID:2064