Analysis
- max time kernel
150s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
01/06/2022, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
1286f2546e331f703a1a15a66d2725f0.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1286f2546e331f703a1a15a66d2725f0.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 1286f2546e331f703a1a15a66d2725f0.exe
- Size 282KB
- Sample220601-197ypscac2
- SHA256 a85ff96e995d7de699d455c7b5f9ca4fc832892080fa640a3d80332c361c624b
- MD5 1286f2546e331f703a1a15a66d2725f0
- SHA1 b53b5376e18bc03a85e8d714df1099090f3395c6
- SHA512 ebae78dc9a6b63bd2bb7d5cf119ec922c7b3bcb2043f8622f6ac4e8e2e9e58a8a4baa0deae2e6ca20d30c0ef13606e80966782b9087612552871d1eb7d9aa30f
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1580 set thread context of 1828 1580 1286f2546e331f703a1a15a66d2725f0.exe 27 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1286f2546e331f703a1a15a66d2725f0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1286f2546e331f703a1a15a66d2725f0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1286f2546e331f703a1a15a66d2725f0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1828 1286f2546e331f703a1a15a66d2725f0.exe 1828 1286f2546e331f703a1a15a66d2725f0.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1828 1286f2546e331f703a1a15a66d2725f0.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1580 wrote to memory of 1828 1580 1286f2546e331f703a1a15a66d2725f0.exe 27 PID 1580 wrote to memory of 1828 1580 1286f2546e331f703a1a15a66d2725f0.exe 27 PID 1580 wrote to memory of 1828 1580 1286f2546e331f703a1a15a66d2725f0.exe 27 PID 1580 wrote to memory of 1828 1580 1286f2546e331f703a1a15a66d2725f0.exe 27 PID 1580 wrote to memory of 1828 1580 1286f2546e331f703a1a15a66d2725f0.exe 27 PID 1580 wrote to memory of 1828 1580 1286f2546e331f703a1a15a66d2725f0.exe 27 PID 1580 wrote to memory of 1828 1580 1286f2546e331f703a1a15a66d2725f0.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\1286f2546e331f703a1a15a66d2725f0.exe"C:\Users\Admin\AppData\Local\Temp\1286f2546e331f703a1a15a66d2725f0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1286f2546e331f703a1a15a66d2725f0.exe"C:\Users\Admin\AppData\Local\Temp\1286f2546e331f703a1a15a66d2725f0.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1828
-