Analysis
- max time kernel
151s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
17/06/2022, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
408f50b15c2c14dec999d62e8e6cd8d8.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
408f50b15c2c14dec999d62e8e6cd8d8.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 408f50b15c2c14dec999d62e8e6cd8d8.exe
- Size 245KB
- Sample220617-ld69zabdan
- SHA256 b77c99b2ff7ff3cdb760dd225abc944f04807f3679d765b7f0a2865a3c60af2e
- MD5 408f50b15c2c14dec999d62e8e6cd8d8
- SHA1 c64d2a50bf31122772d9d2c1ed35358785a30384
- SHA512 0eeac40a28227fca43e7dd1108a63f04097877826035c2c614ad81421ad99ff609e563f3dde173c489591c8065a36856724f60e9001a9335d06c583c91ce889e
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1580 set thread context of 1800 1580 408f50b15c2c14dec999d62e8e6cd8d8.exe 27 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 408f50b15c2c14dec999d62e8e6cd8d8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 408f50b15c2c14dec999d62e8e6cd8d8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 408f50b15c2c14dec999d62e8e6cd8d8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1800 408f50b15c2c14dec999d62e8e6cd8d8.exe 1800 408f50b15c2c14dec999d62e8e6cd8d8.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1800 408f50b15c2c14dec999d62e8e6cd8d8.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1580 wrote to memory of 1800 1580 408f50b15c2c14dec999d62e8e6cd8d8.exe 27 PID 1580 wrote to memory of 1800 1580 408f50b15c2c14dec999d62e8e6cd8d8.exe 27 PID 1580 wrote to memory of 1800 1580 408f50b15c2c14dec999d62e8e6cd8d8.exe 27 PID 1580 wrote to memory of 1800 1580 408f50b15c2c14dec999d62e8e6cd8d8.exe 27 PID 1580 wrote to memory of 1800 1580 408f50b15c2c14dec999d62e8e6cd8d8.exe 27 PID 1580 wrote to memory of 1800 1580 408f50b15c2c14dec999d62e8e6cd8d8.exe 27 PID 1580 wrote to memory of 1800 1580 408f50b15c2c14dec999d62e8e6cd8d8.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\408f50b15c2c14dec999d62e8e6cd8d8.exe"C:\Users\Admin\AppData\Local\Temp\408f50b15c2c14dec999d62e8e6cd8d8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\408f50b15c2c14dec999d62e8e6cd8d8.exe"C:\Users\Admin\AppData\Local\Temp\408f50b15c2c14dec999d62e8e6cd8d8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1800
-