Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
04-07-2022 20:28
Static task
static1
General
-
Target
f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe
-
Size
202KB
-
MD5
7e948ac0336182702bdc791b870dbff7
-
SHA1
f71f24607d8ac75e0fac19afa8a745aff1f628f2
-
SHA256
f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a
-
SHA512
ce19ee81457f884f75c34e86d06072b33056593c2760762051451a3766c8220622409ce489afccd4c5374b7d43d3e68acd1ff62796eb055351e71cca79349edc
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe -
Processes:
f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe -
Drops file in Program Files directory 2 IoCs
Processes:
f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisvc.exe f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exepid process 4316 f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe 4316 f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe 4316 f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exepid process 4316 f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exedescription pid process Token: SeDebugPrivilege 4316 f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe"C:\Users\Admin\AppData\Local\Temp\f64ef9de75ba297ed09efed49035c3035b4f5774da87cb74497302341d68054a.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4316-114-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-115-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-116-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-118-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-117-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-119-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-120-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-121-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-122-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-123-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-124-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-125-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-126-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-127-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-128-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-129-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-130-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-131-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-132-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-133-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-134-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-135-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-136-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-137-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-138-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-139-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-140-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-141-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-142-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-143-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-144-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-145-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-146-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-147-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-148-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-149-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-150-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-151-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-152-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-153-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-154-0x0000000073AD0000-0x0000000074080000-memory.dmpFilesize
5.7MB
-
memory/4316-155-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-156-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-157-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-158-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-159-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-160-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-161-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-162-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-163-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-164-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-165-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-166-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-167-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-168-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-169-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-170-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-171-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-172-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-173-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-174-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-175-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-176-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-177-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-178-0x0000000077750000-0x00000000778DE000-memory.dmpFilesize
1.6MB
-
memory/4316-180-0x0000000073AD0000-0x0000000074080000-memory.dmpFilesize
5.7MB