Analysis
-
max time kernel
151s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-06-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
35ca5ef18f678a30569bbd438f6a5b1d.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
35ca5ef18f678a30569bbd438f6a5b1d.exe
-
Size
177KB
-
MD5
35ca5ef18f678a30569bbd438f6a5b1d
-
SHA1
487433c4c33f1af8b87045ebdc0df76b46c7b0dd
-
SHA256
66dac97c59b5cacc0ff9ade1f96ea85f242eb327c4ad7a5b63e9bdc6e549ebe0
-
SHA512
39947ece578b2e73fc1147597eba7c802f3e90f4aaa487bc6fec74ddc2f4cc8f7a640e397ad01c7cf3ee366f528de2b7f8fc1e4054a12dfda775eb9e96cefd37
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
35ca5ef18f678a30569bbd438f6a5b1d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 35ca5ef18f678a30569bbd438f6a5b1d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 35ca5ef18f678a30569bbd438f6a5b1d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 35ca5ef18f678a30569bbd438f6a5b1d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
35ca5ef18f678a30569bbd438f6a5b1d.exepid process 1000 35ca5ef18f678a30569bbd438f6a5b1d.exe 1000 35ca5ef18f678a30569bbd438f6a5b1d.exe 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
35ca5ef18f678a30569bbd438f6a5b1d.exepid process 1000 35ca5ef18f678a30569bbd438f6a5b1d.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1000-54-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1000-56-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/1000-55-0x0000000000A5E000-0x0000000000A66000-memory.dmpFilesize
32KB
-
memory/1000-57-0x0000000000400000-0x00000000008F6000-memory.dmpFilesize
5.0MB
-
memory/1000-58-0x0000000000400000-0x00000000008F6000-memory.dmpFilesize
5.0MB