Analysis
- max time kernel
151s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
14/07/2022, 06:59
Static task
static1
Behavioral task
behavioral1
Sample
4d4de9714a1d888f6070d676363518ae.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4d4de9714a1d888f6070d676363518ae.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 4d4de9714a1d888f6070d676363518ae.exe
- Size 265KB
- Sample220714-hr4t8aecd7
- SHA256 c4e4941b22293175166737686128c2fa6c51781f1434253df4e0624ecf96a802
- MD5 4d4de9714a1d888f6070d676363518ae
- SHA1 14b8151cc8c38d16a177aaeb3e633b8c68b41ad3
- SHA512 cda06c66360448f1a21de72c0e10dd011e75b8945d1cf759dc69aa14124132a824b136dc092c79cf4fc3fa6a628bd0e858cb525bb7a0762a38d40ee179f7dc1d
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4d4de9714a1d888f6070d676363518ae.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4d4de9714a1d888f6070d676363518ae.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4d4de9714a1d888f6070d676363518ae.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1284 4d4de9714a1d888f6070d676363518ae.exe 1284 4d4de9714a1d888f6070d676363518ae.exe 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1284 4d4de9714a1d888f6070d676363518ae.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1272 Process not Found