Analysis
- max time kernel
156s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
14/07/2022, 06:32
General
- Target 614bb69bdac198bd18bc72029f9af74b.exe
- Size 193KB
- Sample220714-har44adcd4
- SHA256 ecbb1f7a611cecca35df543b53b0f7d5ebeec8cab17d98e98c3e571b380c2374
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\614bb69bdac198bd18bc72029f9af74b.exe"C:\Users\Admin\AppData\Local\Temp\614bb69bdac198bd18bc72029f9af74b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7D49.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7D49.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\9BDE.exeC:\Users\Admin\AppData\Local\Temp\9BDE.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
7D49.dll
7D49.dll
9BDE.exe
9BDE.exe
memory/100-145-0x0000000000AAD000-0x0000000000ABD000-memory.dmp
memory/100-148-0x0000000000400000-0x0000000000A1C000-memory.dmp
memory/100-147-0x0000000000400000-0x0000000000A1C000-memory.dmp
memory/100-146-0x0000000000B90000-0x0000000000B99000-memory.dmp
memory/380-133-0x0000000002C90000-0x0000000002C99000-memory.dmp
memory/380-135-0x0000000000400000-0x0000000002C4F000-memory.dmp
memory/380-132-0x0000000000400000-0x0000000002C4F000-memory.dmp
memory/380-131-0x0000000002C90000-0x0000000002C99000-memory.dmp
memory/380-134-0x0000000002CBE000-0x0000000002CCC000-memory.dmp
memory/380-130-0x0000000002CBE000-0x0000000002CCC000-memory.dmp
memory/4120-144-0x0000000004A00000-0x0000000004ABF000-memory.dmp
memory/4120-143-0x0000000004790000-0x000000000493C000-memory.dmp
memory/4120-149-0x0000000004AD0000-0x0000000004B88000-memory.dmp
memory/4120-150-0x0000000004BA0000-0x0000000004C44000-memory.dmp
memory/4120-151-0x0000000004BA0000-0x0000000004C44000-memory.dmp
memory/4120-153-0x0000000004A00000-0x0000000004ABF000-memory.dmp