Analysis
- max time kernel
188s - max time network
45s - platform
windows7_x64 - resource
win7-20220414-en - submitted
14/07/2022, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
5e1fb9c0a6ccf8cee26df28ab81f96e8.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5e1fb9c0a6ccf8cee26df28ab81f96e8.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe
- Size 191KB
- Sample220714-e399ladeel
- SHA256 b15d795c0b65e15623fc8f6eb4487e60cf2251572f9bca8f0ec078885df51b14
- MD5 5e1fb9c0a6ccf8cee26df28ab81f96e8
- SHA1 d9668b9e10b8fc8fee49f23d298012bf06e0b4f0
- SHA512 440a6d2c19739e5f96d5e272026ebec3d5d9a3c211f3ed6bf14bea8f5e6031f9e4d239405af82c1a4719c29fdf24cf1fe1c7a57bdd5a972b8f839a57f9a630b0
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1868 set thread context of 1764 1868 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 28 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1764 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 1764 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1764 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1268 Process not Found - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1868 wrote to memory of 1764 1868 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 28 PID 1868 wrote to memory of 1764 1868 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 28 PID 1868 wrote to memory of 1764 1868 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 28 PID 1868 wrote to memory of 1764 1868 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 28 PID 1868 wrote to memory of 1764 1868 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 28 PID 1868 wrote to memory of 1764 1868 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 28 PID 1868 wrote to memory of 1764 1868 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e1fb9c0a6ccf8cee26df28ab81f96e8.exe"C:\Users\Admin\AppData\Local\Temp\5e1fb9c0a6ccf8cee26df28ab81f96e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\5e1fb9c0a6ccf8cee26df28ab81f96e8.exe"C:\Users\Admin\AppData\Local\Temp\5e1fb9c0a6ccf8cee26df28ab81f96e8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1764
-