4bb31847846180bf78033b5eb7761b874b114f6dd086862472915be761fc042a

Analysis

max time kernel
152s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09-06-2022 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7zS8A52FD1B/62a1ea2df066e_add786971.exe
Size

172KB
MD5

fa026e2025aee68f7a28808eba6f09af
SHA1

28033d304e34b1989d6e6214f962b937f7359856
SHA256

06760e7403eeb738fc2cd8c2c9d1597ce9628294332aa66d85f6630659a2486c
SHA512

8b206e0ee721a74dbd5f6da921f3e7ed176c048e4814768b5c620c5e90581e7d0279d2603033f5cc98917ad537a87ec459a39f057c8e2beb8d7204e282c2f038

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

62a1ea2df066e_add786971.exe

description pid process target process

PID 4044 set thread context of 4896 4044 62a1ea2df066e_add786971.exe 62a1ea2df066e_add786971.exe

description	pid	process	target process
PID 4044 set thread context of 4896	4044	62a1ea2df066e_add786971.exe	62a1ea2df066e_add786971.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

62a1ea2df066e_add786971.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	62a1ea2df066e_add786971.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	62a1ea2df066e_add786971.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	62a1ea2df066e_add786971.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

62a1ea2df066e_add786971.exe

pid	process
4896	62a1ea2df066e_add786971.exe
4896	62a1ea2df066e_add786971.exe
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3004
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

62a1ea2df066e_add786971.exe

pid process

4896 62a1ea2df066e_add786971.exe

pid	process
3004

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

62a1ea2df066e_add786971.exe

description	pid	process	target process
PID 4044 wrote to memory of 4896	4044	62a1ea2df066e_add786971.exe	62a1ea2df066e_add786971.exe
PID 4044 wrote to memory of 4896	4044	62a1ea2df066e_add786971.exe	62a1ea2df066e_add786971.exe
PID 4044 wrote to memory of 4896	4044	62a1ea2df066e_add786971.exe	62a1ea2df066e_add786971.exe
PID 4044 wrote to memory of 4896	4044	62a1ea2df066e_add786971.exe	62a1ea2df066e_add786971.exe
PID 4044 wrote to memory of 4896	4044	62a1ea2df066e_add786971.exe	62a1ea2df066e_add786971.exe
PID 4044 wrote to memory of 4896	4044	62a1ea2df066e_add786971.exe	62a1ea2df066e_add786971.exe

C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2df066e_add786971.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2df066e_add786971.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4044

C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2df066e_add786971.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2df066e_add786971.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4044-130-0x0000000000A6D000-0x0000000000A76000-memory.dmp

Filesize
36KB

Download
memory/4044-131-0x0000000002630000-0x0000000002639000-memory.dmp

Filesize
36KB

Download
memory/4044-134-0x0000000000A6D000-0x0000000000A76000-memory.dmp

Filesize
36KB

Download
memory/4896-132-0x0000000000000000-mapping.dmp

Download
memory/4896-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4896-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4896-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download