Analysis
-
max time kernel
9s -
max time network
8s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 15:47
Static task
static1
Behavioral task
behavioral1
Sample
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe
Resource
win10-en-20211208
General
-
Target
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe
-
Size
312KB
-
MD5
6ae0d6efc218e9c89545872d79264bad
-
SHA1
26cc0c343d8f46bb4f526952cfd954d89fc41021
-
SHA256
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09
-
SHA512
e6a9b8bafa000ef3b8f58b6684a4381de03f066206835bee0857c575800d39794e6af0b77c945eba17d1c3096c05f836d69f6357bd8664728408f21f6af125da
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exedescription pid process target process PID 528 set thread context of 1876 528 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exepid process 1876 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 1876 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exedescription pid process target process PID 528 wrote to memory of 1876 528 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 528 wrote to memory of 1876 528 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 528 wrote to memory of 1876 528 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 528 wrote to memory of 1876 528 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 528 wrote to memory of 1876 528 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 528 wrote to memory of 1876 528 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 528 wrote to memory of 1876 528 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe"C:\Users\Admin\AppData\Local\Temp\001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe"C:\Users\Admin\AppData\Local\Temp\001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/528-54-0x00000000006A0000-0x00000000006CA000-memory.dmpFilesize
168KB
-
memory/528-55-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1876-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1876-57-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB