Analysis
-
max time kernel
165s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 16:08
Static task
static1
Behavioral task
behavioral1
Sample
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe
-
Size
484KB
-
MD5
124d636100ebd7a0150b180a54536108
-
SHA1
1961e8a42971d2d40226f9c5bc405e81430d10b0
-
SHA256
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be
-
SHA512
b55d5380f4d02881838591a15047a42c8da784faf78a0f0aa592d7c9be6aa240bd0c30fc606c018ccec645afdbd05958a0e3e3fc2aebe2edbd7a4b96ce12194f
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe" 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe -
Processes:
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exedescription pid process target process PID 392 set thread context of 3468 392 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe -
Drops file in Program Files directory 2 IoCs
Processes:
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exedescription ioc process File created C:\Program Files (x86)\SCSI Subsystem\scsiss.exe 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe File opened for modification C:\Program Files (x86)\SCSI Subsystem\scsiss.exe 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exepid process 3468 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe 3468 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe 3468 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exepid process 3468 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exedescription pid process Token: SeDebugPrivilege 3468 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exepid process 392 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exedescription pid process target process PID 392 wrote to memory of 3468 392 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe PID 392 wrote to memory of 3468 392 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe PID 392 wrote to memory of 3468 392 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe 3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe"C:\Users\Admin\AppData\Local\Temp\3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exeC:\Users\Admin\AppData\Local\Temp\3b8aa90ed1f241485bce6c194bb553fcd8dc1e06c94ddc95e5f36dcccdb341be.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-132-0x0000000002A80000-0x0000000002A87000-memory.dmpFilesize
28KB
-
memory/392-134-0x0000000077960000-0x0000000077B03000-memory.dmpFilesize
1.6MB
-
memory/3468-133-0x0000000000000000-mapping.dmp
-
memory/3468-135-0x0000000002080000-0x0000000002087000-memory.dmpFilesize
28KB
-
memory/3468-137-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/3468-136-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3468-138-0x0000000077960000-0x0000000077B03000-memory.dmpFilesize
1.6MB
-
memory/3468-139-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/3468-140-0x0000000077960000-0x0000000077B03000-memory.dmpFilesize
1.6MB
-
memory/3468-141-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB