7e00e2f5bcbb37e95022c1734f146d6232ad0a9f86d0cf1329de6cf600f829da

General

Target

ac0dcb5f89023442bd8d41646f8c808c.exe
Size

2.0MB
MD5

ac0dcb5f89023442bd8d41646f8c808c
SHA1

b44eb37711858f0c861f0ed0a6739ff9fdc17c7a
SHA256

7e00e2f5bcbb37e95022c1734f146d6232ad0a9f86d0cf1329de6cf600f829da
SHA512

98bc1ab4b06e754f5e613340eab743e3ec9143a9622da0fe21c5678093c5cb36406769aa01e808cb4728a56998de797844004d1fb9be2b9f630760f8d80d5a3a

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ac0dcb5f89023442bd8d41646f8c808c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	ac0dcb5f89023442bd8d41646f8c808c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	ac0dcb5f89023442bd8d41646f8c808c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	ac0dcb5f89023442bd8d41646f8c808c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	ac0dcb5f89023442bd8d41646f8c808c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	ac0dcb5f89023442bd8d41646f8c808c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	ac0dcb5f89023442bd8d41646f8c808c.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3164 PING.EXE

pid	process
3164	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ac0dcb5f89023442bd8d41646f8c808c.exeac0dcb5f89023442bd8d41646f8c808c.exe

pid	process
4644	ac0dcb5f89023442bd8d41646f8c808c.exe
4644	ac0dcb5f89023442bd8d41646f8c808c.exe
808	ac0dcb5f89023442bd8d41646f8c808c.exe
808	ac0dcb5f89023442bd8d41646f8c808c.exe
808	ac0dcb5f89023442bd8d41646f8c808c.exe
808	ac0dcb5f89023442bd8d41646f8c808c.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ac0dcb5f89023442bd8d41646f8c808c.execmd.exe

description	pid	process	target process
PID 4644 wrote to memory of 808	4644	ac0dcb5f89023442bd8d41646f8c808c.exe	ac0dcb5f89023442bd8d41646f8c808c.exe
PID 4644 wrote to memory of 808	4644	ac0dcb5f89023442bd8d41646f8c808c.exe	ac0dcb5f89023442bd8d41646f8c808c.exe
PID 4644 wrote to memory of 808	4644	ac0dcb5f89023442bd8d41646f8c808c.exe	ac0dcb5f89023442bd8d41646f8c808c.exe
PID 4644 wrote to memory of 4204	4644	ac0dcb5f89023442bd8d41646f8c808c.exe	cmd.exe
PID 4644 wrote to memory of 4204	4644	ac0dcb5f89023442bd8d41646f8c808c.exe	cmd.exe
PID 4644 wrote to memory of 4204	4644	ac0dcb5f89023442bd8d41646f8c808c.exe	cmd.exe
PID 4204 wrote to memory of 3164	4204	cmd.exe	PING.EXE
PID 4204 wrote to memory of 3164	4204	cmd.exe	PING.EXE
PID 4204 wrote to memory of 3164	4204	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe
"C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe
  C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-0-0x0000000000000000-mapping.dmp

Download
memory/808-1-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/3164-3-0x0000000000000000-mapping.dmp

Download
memory/4204-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads