Analysis
- max time kernel
150s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
09/06/2022, 00:27
Static task
static1
Behavioral task
behavioral1
Sample
bf917e9c2f954ccd846bc62bfb616a4b.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bf917e9c2f954ccd846bc62bfb616a4b.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target bf917e9c2f954ccd846bc62bfb616a4b.exe
- Size 265KB
- Sample220609-arrkwschh6
- SHA256 4a996631026f70f0fc46e06f0c190d89fc91c71e4fa6a3deca9aeab4d5232df4
- MD5 bf917e9c2f954ccd846bc62bfb616a4b
- SHA1 262c3ad338250227bb1da690e74759bbcca2291c
- SHA512 e4a2dea9f7afd3bee85a1d4a91af87ab829a2fe87c7ff2cebed82edb4b75c78865f895fe7268347145566eb80c3a076563b92a896ea838549c7d7fc2c07490f8
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1556 jrubdjs 1368 jrubdjs - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1092 set thread context of 4360 1092 bf917e9c2f954ccd846bc62bfb616a4b.exe 80 PID 1556 set thread context of 1368 1556 jrubdjs 89 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bf917e9c2f954ccd846bc62bfb616a4b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jrubdjs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jrubdjs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jrubdjs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bf917e9c2f954ccd846bc62bfb616a4b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bf917e9c2f954ccd846bc62bfb616a4b.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4360 bf917e9c2f954ccd846bc62bfb616a4b.exe 4360 bf917e9c2f954ccd846bc62bfb616a4b.exe 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found 3252 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3252 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4360 bf917e9c2f954ccd846bc62bfb616a4b.exe 1368 jrubdjs - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3252 Process not Found Token: SeCreatePagefilePrivilege 3252 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1092 wrote to memory of 4360 1092 bf917e9c2f954ccd846bc62bfb616a4b.exe 80 PID 1092 wrote to memory of 4360 1092 bf917e9c2f954ccd846bc62bfb616a4b.exe 80 PID 1092 wrote to memory of 4360 1092 bf917e9c2f954ccd846bc62bfb616a4b.exe 80 PID 1092 wrote to memory of 4360 1092 bf917e9c2f954ccd846bc62bfb616a4b.exe 80 PID 1092 wrote to memory of 4360 1092 bf917e9c2f954ccd846bc62bfb616a4b.exe 80 PID 1092 wrote to memory of 4360 1092 bf917e9c2f954ccd846bc62bfb616a4b.exe 80 PID 1556 wrote to memory of 1368 1556 jrubdjs 89 PID 1556 wrote to memory of 1368 1556 jrubdjs 89 PID 1556 wrote to memory of 1368 1556 jrubdjs 89 PID 1556 wrote to memory of 1368 1556 jrubdjs 89 PID 1556 wrote to memory of 1368 1556 jrubdjs 89 PID 1556 wrote to memory of 1368 1556 jrubdjs 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf917e9c2f954ccd846bc62bfb616a4b.exe"C:\Users\Admin\AppData\Local\Temp\bf917e9c2f954ccd846bc62bfb616a4b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\bf917e9c2f954ccd846bc62bfb616a4b.exe"C:\Users\Admin\AppData\Local\Temp\bf917e9c2f954ccd846bc62bfb616a4b.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4360
-
-
C:\Users\Admin\AppData\Roaming\jrubdjsC:\Users\Admin\AppData\Roaming\jrubdjs1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Roaming\jrubdjsC:\Users\Admin\AppData\Roaming\jrubdjs2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1368
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\jrubdjs
- Size 265KB
- SHA256 4a996631026f70f0fc46e06f0c190d89fc91c71e4fa6a3deca9aeab4d5232df4
- MD5 bf917e9c2f954ccd846bc62bfb616a4b
- SHA1 262c3ad338250227bb1da690e74759bbcca2291c
- SHA512 e4a2dea9f7afd3bee85a1d4a91af87ab829a2fe87c7ff2cebed82edb4b75c78865f895fe7268347145566eb80c3a076563b92a896ea838549c7d7fc2c07490f8
- SSDEEP 3072:En7ECEiyFUpqxx8zqXp6RU4IgP/CZ76UwejmlTMjMCc3++d7MKVmFHymQ5EXJd0n:Yh0x8zq5vWyNw+aTMjq3+6fmFfxsee
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\jrubdjs
- Size 265KB
- SHA256 4a996631026f70f0fc46e06f0c190d89fc91c71e4fa6a3deca9aeab4d5232df4
- MD5 bf917e9c2f954ccd846bc62bfb616a4b
- SHA1 262c3ad338250227bb1da690e74759bbcca2291c
- SHA512 e4a2dea9f7afd3bee85a1d4a91af87ab829a2fe87c7ff2cebed82edb4b75c78865f895fe7268347145566eb80c3a076563b92a896ea838549c7d7fc2c07490f8
- SSDEEP 3072:En7ECEiyFUpqxx8zqXp6RU4IgP/CZ76UwejmlTMjMCc3++d7MKVmFHymQ5EXJd0n:Yh0x8zq5vWyNw+aTMjq3+6fmFfxsee
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\jrubdjs
- Size 265KB
- SHA256 4a996631026f70f0fc46e06f0c190d89fc91c71e4fa6a3deca9aeab4d5232df4
- MD5 bf917e9c2f954ccd846bc62bfb616a4b
- SHA1 262c3ad338250227bb1da690e74759bbcca2291c
- SHA512 e4a2dea9f7afd3bee85a1d4a91af87ab829a2fe87c7ff2cebed82edb4b75c78865f895fe7268347145566eb80c3a076563b92a896ea838549c7d7fc2c07490f8
- SSDEEP 3072:En7ECEiyFUpqxx8zqXp6RU4IgP/CZ76UwejmlTMjMCc3++d7MKVmFHymQ5EXJd0n:Yh0x8zq5vWyNw+aTMjq3+6fmFfxsee
- MD5 SHA1 SHA512 SSDEEP