8bb82ff08884c097ed800b513c62461a76353f8d53e6815b5732d86bfeecda26

General

Target

ffe8eef3d39819b7f645aff69158f469.exe
Size

1.0MB
MD5

ffe8eef3d39819b7f645aff69158f469
SHA1

1ee81fafb9d404a49a91bcdc6a567ca552496eaa
SHA256

8bb82ff08884c097ed800b513c62461a76353f8d53e6815b5732d86bfeecda26
SHA512

cbe8c9cae62621bc8dbd297ac06866b428f593ef495eb688debd6c8a671bb66df5f8621733322cffb403cad47859f2d6a77af2bfa2f585bf288481bc547de885

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ffe8eef3d39819b7f645aff69158f469.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\siowvi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Yuiurgg\\ncajpuww.exe\""	ffe8eef3d39819b7f645aff69158f469.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ffe8eef3d39819b7f645aff69158f469.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	ffe8eef3d39819b7f645aff69158f469.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	ffe8eef3d39819b7f645aff69158f469.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	ffe8eef3d39819b7f645aff69158f469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	ffe8eef3d39819b7f645aff69158f469.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	ffe8eef3d39819b7f645aff69158f469.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	ffe8eef3d39819b7f645aff69158f469.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3772 schtasks.exe

pid	process
3772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

ffe8eef3d39819b7f645aff69158f469.exeffe8eef3d39819b7f645aff69158f469.exeffe8eef3d39819b7f645aff69158f469.exe

pid	process
972	ffe8eef3d39819b7f645aff69158f469.exe
972	ffe8eef3d39819b7f645aff69158f469.exe
2092	ffe8eef3d39819b7f645aff69158f469.exe
2092	ffe8eef3d39819b7f645aff69158f469.exe
2092	ffe8eef3d39819b7f645aff69158f469.exe
2092	ffe8eef3d39819b7f645aff69158f469.exe
1260	ffe8eef3d39819b7f645aff69158f469.exe
1260	ffe8eef3d39819b7f645aff69158f469.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ffe8eef3d39819b7f645aff69158f469.exe

description	pid	process	target process
PID 972 wrote to memory of 2092	972	ffe8eef3d39819b7f645aff69158f469.exe	ffe8eef3d39819b7f645aff69158f469.exe
PID 972 wrote to memory of 2092	972	ffe8eef3d39819b7f645aff69158f469.exe	ffe8eef3d39819b7f645aff69158f469.exe
PID 972 wrote to memory of 2092	972	ffe8eef3d39819b7f645aff69158f469.exe	ffe8eef3d39819b7f645aff69158f469.exe
PID 972 wrote to memory of 3772	972	ffe8eef3d39819b7f645aff69158f469.exe	schtasks.exe
PID 972 wrote to memory of 3772	972	ffe8eef3d39819b7f645aff69158f469.exe	schtasks.exe
PID 972 wrote to memory of 3772	972	ffe8eef3d39819b7f645aff69158f469.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\ffe8eef3d39819b7f645aff69158f469.exe
"C:\Users\Admin\AppData\Local\Temp\ffe8eef3d39819b7f645aff69158f469.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\ffe8eef3d39819b7f645aff69158f469.exe
C:\Users\Admin\AppData\Local\Temp\ffe8eef3d39819b7f645aff69158f469.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2092

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn txhhyhwq /tr "\"C:\Users\Admin\AppData\Local\Temp\ffe8eef3d39819b7f645aff69158f469.exe\" /I txhhyhwq" /SC ONCE /Z /ST 18:19 /ET 18:31
2⤵
- Creates scheduled task(s)
PID:3772

C:\Users\Admin\AppData\Local\Temp\ffe8eef3d39819b7f645aff69158f469.exe
C:\Users\Admin\AppData\Local\Temp\ffe8eef3d39819b7f645aff69158f469.exe /I txhhyhwq
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1260

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-2-0x0000000000000000-mapping.dmp

Download
memory/2092-3-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/3772-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads