Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
04/07/2022, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
4c2c5fd5d25acae74f05aefe6f3e1333.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4c2c5fd5d25acae74f05aefe6f3e1333.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 4c2c5fd5d25acae74f05aefe6f3e1333.exe
- Size 287KB
- Sample220704-j95d5sffar
- SHA256 68a1fb3df34adeba1b258d241722bfd26a5487bda55401d74ec4ee13f0eafe65
- MD5 4c2c5fd5d25acae74f05aefe6f3e1333
- SHA1 44eb314e9761ee297214ebceb4038e77f15e03e1
- SHA512 9cd8e3ca4abf32e69fc2172fd7adb4c23826e0f885f6d8c06ef9cb83d5c5e048ce4a5d875c55e7e03cff68413489180fc6e150a90fb0709d845119bc7230e0e3
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4100 set thread context of 4644 4100 4c2c5fd5d25acae74f05aefe6f3e1333.exe 80 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4c2c5fd5d25acae74f05aefe6f3e1333.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4c2c5fd5d25acae74f05aefe6f3e1333.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4c2c5fd5d25acae74f05aefe6f3e1333.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 4c2c5fd5d25acae74f05aefe6f3e1333.exe 4644 4c2c5fd5d25acae74f05aefe6f3e1333.exe 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found 1060 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1060 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4644 4c2c5fd5d25acae74f05aefe6f3e1333.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4100 wrote to memory of 4644 4100 4c2c5fd5d25acae74f05aefe6f3e1333.exe 80 PID 4100 wrote to memory of 4644 4100 4c2c5fd5d25acae74f05aefe6f3e1333.exe 80 PID 4100 wrote to memory of 4644 4100 4c2c5fd5d25acae74f05aefe6f3e1333.exe 80 PID 4100 wrote to memory of 4644 4100 4c2c5fd5d25acae74f05aefe6f3e1333.exe 80 PID 4100 wrote to memory of 4644 4100 4c2c5fd5d25acae74f05aefe6f3e1333.exe 80 PID 4100 wrote to memory of 4644 4100 4c2c5fd5d25acae74f05aefe6f3e1333.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c2c5fd5d25acae74f05aefe6f3e1333.exe"C:\Users\Admin\AppData\Local\Temp\4c2c5fd5d25acae74f05aefe6f3e1333.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4c2c5fd5d25acae74f05aefe6f3e1333.exe"C:\Users\Admin\AppData\Local\Temp\4c2c5fd5d25acae74f05aefe6f3e1333.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4644
-