884852c74e05d43e1e7ef7cfb62aedc1bf29b4b137bb0d1180cea5c2640aceed

General

Target
717fe4fd6b4c6fd08092f062e31493d2.exe
Size 269KB
Sample201025-2fc3syqfbn
SHA256 884852c74e05d43e1e7ef7cfb62aedc1bf29b4b137bb0d1180cea5c2640aceed
MD5 717fe4fd6b4c6fd08092f062e31493d2
SHA1 c701e8a2032abe4903137a4ce0a90a25ae235ec9
SHA512 4c17833327de0cb959bff1f2fdff659cb2c13ea9f4e83e4d09e44fd9c443feb68bf40abc6f1af4cfda0f2920fae5b0587ee020cdf3a5e66de52f10f814ced379
MD5 SHA1 SHA512

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\iowfb = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Oygdmxgijku\\lytjixf.exe\""	717fe4fd6b4c6fd08092f062e31493d2.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	717fe4fd6b4c6fd08092f062e31493d2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	717fe4fd6b4c6fd08092f062e31493d2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	717fe4fd6b4c6fd08092f062e31493d2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	717fe4fd6b4c6fd08092f062e31493d2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	717fe4fd6b4c6fd08092f062e31493d2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	717fe4fd6b4c6fd08092f062e31493d2.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2536	3020	717fe4fd6b4c6fd08092f062e31493d2.exe	77
PID 3020 wrote to memory of 2536	3020	717fe4fd6b4c6fd08092f062e31493d2.exe	77
PID 3020 wrote to memory of 2536	3020	717fe4fd6b4c6fd08092f062e31493d2.exe	77
PID 3020 wrote to memory of 3676	3020	717fe4fd6b4c6fd08092f062e31493d2.exe	78
PID 3020 wrote to memory of 3676	3020	717fe4fd6b4c6fd08092f062e31493d2.exe	78
PID 3020 wrote to memory of 3676	3020	717fe4fd6b4c6fd08092f062e31493d2.exe	78

C:\Users\Admin\AppData\Local\Temp\717fe4fd6b4c6fd08092f062e31493d2.exe
"C:\Users\Admin\AppData\Local\Temp\717fe4fd6b4c6fd08092f062e31493d2.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\717fe4fd6b4c6fd08092f062e31493d2.exe
  C:\Users\Admin\AppData\Local\Temp\717fe4fd6b4c6fd08092f062e31493d2.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vudeyjm /tr "\"C:\Users\Admin\AppData\Local\Temp\717fe4fd6b4c6fd08092f062e31493d2.exe\" /I vudeyjm" /SC ONCE /Z /ST 23:13 /ET 23:25
  2⤵
  - Creates scheduled task(s)
  PID:3676

C:\Users\Admin\AppData\Local\Temp\717fe4fd6b4c6fd08092f062e31493d2.exe
C:\Users\Admin\AppData\Local\Temp\717fe4fd6b4c6fd08092f062e31493d2.exe /I vudeyjm
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2020