d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d

General

Target
d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
Size 270KB
Sample201114-2ae2lvtd32
SHA256 d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d
MD5 212712e6b7c088fe10aa419925d1bbcf
SHA1 4790b8da7d51a02c1d93db08c88d3a9fbbe20d83
SHA512 8e307d82c65e027b33c59fa05428972984f25a9803a682d5d8db95ad4f75c993f70c6b1d56ecb1080e4c97c7fd5bd9c6a384efdc2cf6171bf0daa2680045a8e3
MD5 SHA1 SHA512

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\dtmnmyyu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Myxyjuus\\jiuxvnk.exe\""	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3412	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
3412	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
1508	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
1508	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
1508	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
1508	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1508	3412	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe	79
PID 3412 wrote to memory of 1508	3412	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe	79
PID 3412 wrote to memory of 1508	3412	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe	79
PID 3412 wrote to memory of 2212	3412	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe	80
PID 3412 wrote to memory of 2212	3412	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe	80
PID 3412 wrote to memory of 2212	3412	d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe	80

C:\Users\Admin\AppData\Local\Temp\d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
"C:\Users\Admin\AppData\Local\Temp\d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
  C:\Users\Admin\AppData\Local\Temp\d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qqismbi /tr "\"C:\Users\Admin\AppData\Local\Temp\d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe\" /I qqismbi" /SC ONCE /Z /ST 20:17 /ET 20:29
  2⤵
  - Creates scheduled task(s)
  PID:2212

C:\Users\Admin\AppData\Local\Temp\d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe
C:\Users\Admin\AppData\Local\Temp\d6d0296bf08fd32704986b6bdca105053c3b4edf3fa8cb06b929cdeac5bc599d.exe /I qqismbi
1⤵
PID:3764