Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09-06-2022 14:12
General
-
Target
7zS8A52FD1B/62a1ea2df066e_add786971.exe
-
Size
172KB
-
MD5
fa026e2025aee68f7a28808eba6f09af
-
SHA1
28033d304e34b1989d6e6214f962b937f7359856
-
SHA256
06760e7403eeb738fc2cd8c2c9d1597ce9628294332aa66d85f6630659a2486c
-
SHA512
8b206e0ee721a74dbd5f6da921f3e7ed176c048e4814768b5c620c5e90581e7d0279d2603033f5cc98917ad537a87ec459a39f057c8e2beb8d7204e282c2f038
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2df066e_add786971.exe"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2df066e_add786971.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2df066e_add786971.exe"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2df066e_add786971.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1408-56-0x0000000000ACE000-0x0000000000AD7000-memory.dmpFilesize
36KB
-
memory/1408-58-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1952-55-0x0000000000402DD8-mapping.dmp
-
memory/1952-54-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1952-57-0x00000000765C1000-0x00000000765C3000-memory.dmpFilesize
8KB
-
memory/1952-59-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1952-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB