Analysis
- max time kernel
153s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
12/07/2022, 08:51
Static task
static1
Behavioral task
behavioral1
Sample
62d597618dd39982b9a997baa5fc25c2.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
62d597618dd39982b9a997baa5fc25c2.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 62d597618dd39982b9a997baa5fc25c2.exe
- Size 322KB
- Sample220712-kr54dsahbm
- SHA256 b811ea6c96c40fdb9d0353ada3b366abce302b105ceb4a8dfcf363849fae8794
- MD5 62d597618dd39982b9a997baa5fc25c2
- SHA1 64dce6d523d4c3a1122d985a5321d622e5c5fced
- SHA512 3a9f6e9b9bb285efb8d1435cfe38a49e272384a6174b41cf2a0c1d27f639203030d1650dafc721e96d5f649fed6e8670e91ec4212694523bbba2641e7dd509e5
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2824 set thread context of 2856 2824 62d597618dd39982b9a997baa5fc25c2.exe 77 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 62d597618dd39982b9a997baa5fc25c2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 62d597618dd39982b9a997baa5fc25c2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 62d597618dd39982b9a997baa5fc25c2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 62d597618dd39982b9a997baa5fc25c2.exe 2856 62d597618dd39982b9a997baa5fc25c2.exe 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found 2040 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2040 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2856 62d597618dd39982b9a997baa5fc25c2.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2856 2824 62d597618dd39982b9a997baa5fc25c2.exe 77 PID 2824 wrote to memory of 2856 2824 62d597618dd39982b9a997baa5fc25c2.exe 77 PID 2824 wrote to memory of 2856 2824 62d597618dd39982b9a997baa5fc25c2.exe 77 PID 2824 wrote to memory of 2856 2824 62d597618dd39982b9a997baa5fc25c2.exe 77 PID 2824 wrote to memory of 2856 2824 62d597618dd39982b9a997baa5fc25c2.exe 77 PID 2824 wrote to memory of 2856 2824 62d597618dd39982b9a997baa5fc25c2.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\62d597618dd39982b9a997baa5fc25c2.exe"C:\Users\Admin\AppData\Local\Temp\62d597618dd39982b9a997baa5fc25c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\62d597618dd39982b9a997baa5fc25c2.exe"C:\Users\Admin\AppData\Local\Temp\62d597618dd39982b9a997baa5fc25c2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2856
-