98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0

General

Target
98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
Size 257KB
Sample201108-k8ptfsd7ns
SHA256 98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0
MD5 cba39bc2cb49a15baa739179303192be
SHA1 cb5d492eb632f6ddaaa3afbe0008a25276b0f2ac
SHA512 8f31ae78ace7ce7a88cc1b829e4b6822d30876866899a37e92c797aa2083155079ec0cdb3df30417084163fe6cbe12de0d2b8d5e5ac61fef2ab4a78d396cc5a1
MD5 SHA1 SHA512

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\evgwp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Ixrloyxo\\dznuxo.exe\""	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4708	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
4708	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
3196	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
3196	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
3196	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
3196	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
3944	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
3944	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3196	4708	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe	78
PID 4708 wrote to memory of 3196	4708	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe	78
PID 4708 wrote to memory of 3196	4708	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe	78
PID 4708 wrote to memory of 3828	4708	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe	79
PID 4708 wrote to memory of 3828	4708	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe	79
PID 4708 wrote to memory of 3828	4708	98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe	79

C:\Users\Admin\AppData\Local\Temp\98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
"C:\Users\Admin\AppData\Local\Temp\98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
  C:\Users\Admin\AppData\Local\Temp\98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ymufidnwfu /tr "\"C:\Users\Admin\AppData\Local\Temp\98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe\" /I ymufidnwfu" /SC ONCE /Z /ST 20:26 /ET 20:38
  2⤵
  - Creates scheduled task(s)
  PID:3828

C:\Users\Admin\AppData\Local\Temp\98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe
C:\Users\Admin\AppData\Local\Temp\98fec009d2ce7d28c7a4fa4da8df368d2de815f32b35ccde3c5b21b587e5bff0.exe /I ymufidnwfu
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944