Analysis
- max time kernel
151s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
08/07/2022, 09:16
Static task
static1
Behavioral task
behavioral1
Sample
fda602521dbc43e00187710a173d2cb3.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fda602521dbc43e00187710a173d2cb3.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target fda602521dbc43e00187710a173d2cb3.exe
- Size 332KB
- Sample220708-k8fvtsahel
- SHA256 6bdbc7ad04df70c80902fac4502179d62f7a67199745cdc5a6fa2d798cb1a8e7
- MD5 fda602521dbc43e00187710a173d2cb3
- SHA1 d92e4265296e99e7a2e79882685685bfe6097087
- SHA512 fb8bc097210213846a52ae1085f4f6cf8d008b57c0460b85bddb3ba4e864d7383622d57a554a59e336e210fd6b47f7f491b849b61fdebc34d2944c1da301c4f0
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4624 set thread context of 2124 4624 fda602521dbc43e00187710a173d2cb3.exe 80 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fda602521dbc43e00187710a173d2cb3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fda602521dbc43e00187710a173d2cb3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fda602521dbc43e00187710a173d2cb3.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2124 fda602521dbc43e00187710a173d2cb3.exe 2124 fda602521dbc43e00187710a173d2cb3.exe 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2628 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2124 fda602521dbc43e00187710a173d2cb3.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4624 wrote to memory of 2124 4624 fda602521dbc43e00187710a173d2cb3.exe 80 PID 4624 wrote to memory of 2124 4624 fda602521dbc43e00187710a173d2cb3.exe 80 PID 4624 wrote to memory of 2124 4624 fda602521dbc43e00187710a173d2cb3.exe 80 PID 4624 wrote to memory of 2124 4624 fda602521dbc43e00187710a173d2cb3.exe 80 PID 4624 wrote to memory of 2124 4624 fda602521dbc43e00187710a173d2cb3.exe 80 PID 4624 wrote to memory of 2124 4624 fda602521dbc43e00187710a173d2cb3.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\fda602521dbc43e00187710a173d2cb3.exe"C:\Users\Admin\AppData\Local\Temp\fda602521dbc43e00187710a173d2cb3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\fda602521dbc43e00187710a173d2cb3.exe"C:\Users\Admin\AppData\Local\Temp\fda602521dbc43e00187710a173d2cb3.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2124
-