Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
13/06/2022, 07:04
Static task
static1
Behavioral task
behavioral1
Sample
8808b755c692dd60e4c08db96ca09ded.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8808b755c692dd60e4c08db96ca09ded.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 8808b755c692dd60e4c08db96ca09ded.exe
- Size 165KB
- Sample220613-hvx6vaedbq
- SHA256 b662d207bc283ca441dc08b1503e6882ed3c45b92e1963a2468f52d3ce191835
- MD5 8808b755c692dd60e4c08db96ca09ded
- SHA1 5980bf1b1d60c3bee89086d2b1f18bb46a70c0b7
- SHA512 56005aa013266aed447e08f3deb48775cd2978c593bfb740f89154d00a09ecc28bdad75309e468d758acf915ed0049de22da5c115550a5ddc8211d95e9614b2b
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3172 set thread context of 5036 3172 8808b755c692dd60e4c08db96ca09ded.exe 80 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8808b755c692dd60e4c08db96ca09ded.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8808b755c692dd60e4c08db96ca09ded.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8808b755c692dd60e4c08db96ca09ded.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5036 8808b755c692dd60e4c08db96ca09ded.exe 5036 8808b755c692dd60e4c08db96ca09ded.exe 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found 2700 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2700 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5036 8808b755c692dd60e4c08db96ca09ded.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3172 wrote to memory of 5036 3172 8808b755c692dd60e4c08db96ca09ded.exe 80 PID 3172 wrote to memory of 5036 3172 8808b755c692dd60e4c08db96ca09ded.exe 80 PID 3172 wrote to memory of 5036 3172 8808b755c692dd60e4c08db96ca09ded.exe 80 PID 3172 wrote to memory of 5036 3172 8808b755c692dd60e4c08db96ca09ded.exe 80 PID 3172 wrote to memory of 5036 3172 8808b755c692dd60e4c08db96ca09ded.exe 80 PID 3172 wrote to memory of 5036 3172 8808b755c692dd60e4c08db96ca09ded.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\8808b755c692dd60e4c08db96ca09ded.exe"C:\Users\Admin\AppData\Local\Temp\8808b755c692dd60e4c08db96ca09ded.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\8808b755c692dd60e4c08db96ca09ded.exe"C:\Users\Admin\AppData\Local\Temp\8808b755c692dd60e4c08db96ca09ded.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5036
-