Analysis
- max time kernel
195s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
14/07/2022, 06:59
Static task
static1
Behavioral task
behavioral1
Sample
7ad4d15bc1714f693138b87113e55ccd.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target 7ad4d15bc1714f693138b87113e55ccd.exe
- Size 246KB
- Sample220714-hr4t8aecd6
- SHA256 23c72e85c5f0e6d3843568913c7c1990e7ff818e23340663b60f078650f6d8bb
- MD5 7ad4d15bc1714f693138b87113e55ccd
- SHA1 370b0a254bfb3fdff11be20494833d3b6bc77e43
- SHA512 73f072e5f131cb6124400cbc0aadf838de36b34e050f384bd6e639628b739f4e11549cb1dc65001655a21b5501be1e28d9fb410d651c97650194b4255c7168f0
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7ad4d15bc1714f693138b87113e55ccd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7ad4d15bc1714f693138b87113e55ccd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7ad4d15bc1714f693138b87113e55ccd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1420 7ad4d15bc1714f693138b87113e55ccd.exe 1420 7ad4d15bc1714f693138b87113e55ccd.exe 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found 1260 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1420 7ad4d15bc1714f693138b87113e55ccd.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1260 Process not Found