Analysis
- max time kernel
150s - max time network
49s - platform
windows7_x64 - resource
win7-20220414-en - submitted
14/07/2022, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
a81445c1b6d3cfac9357bc514c223651.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target a81445c1b6d3cfac9357bc514c223651.exe
- Size 206KB
- Sample220714-fm24qaefek
- SHA256 42247d3cc7635107ddb52bab629358dfd32b4112b81ed083b30c4abd41d00628
- MD5 a81445c1b6d3cfac9357bc514c223651
- SHA1 231b76e88f3d4637587ba6888c998cb10eea81e7
- SHA512 947c4ccb47e54f8613ae2b020bb576edd79f4b2b2487c79bf6a248c3b7716ca323ab74ed22d44c70ccc0c4fcb4f9576b346bfe57738979ffd166732fa4109f82
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a81445c1b6d3cfac9357bc514c223651.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a81445c1b6d3cfac9357bc514c223651.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a81445c1b6d3cfac9357bc514c223651.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 a81445c1b6d3cfac9357bc514c223651.exe 1684 a81445c1b6d3cfac9357bc514c223651.exe 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found 1292 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1684 a81445c1b6d3cfac9357bc514c223651.exe