Analysis
-
max time kernel
15s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-11-2020 02:38
Static task
static1
Behavioral task
behavioral1
Sample
24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe
-
Size
1.0MB
-
MD5
54913eba4af75459add05894f27669ed
-
SHA1
076e4a9a326d253d4fbf9e426b54f6f08cd04aad
-
SHA256
24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643
-
SHA512
a6d19f375aa098a07a35c65184bcb5dd4d50a28590021747086bcb756e380023cdf95926fc459fb9d1d6cd1a2a844035555e89dbf04bdb80beedb344a5da8a7d
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exepid process 492 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe 492 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe 3144 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe 3144 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe 3144 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe 3144 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.execmd.exedescription pid process target process PID 492 wrote to memory of 3144 492 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe PID 492 wrote to memory of 3144 492 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe PID 492 wrote to memory of 3144 492 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe PID 492 wrote to memory of 2608 492 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe cmd.exe PID 492 wrote to memory of 2608 492 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe cmd.exe PID 492 wrote to memory of 2608 492 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe cmd.exe PID 2608 wrote to memory of 4012 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 4012 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 4012 2608 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe"C:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exeC:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe