Analysis
- max time kernel
154s - max time network
191s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
14/07/2022, 06:59
Static task
static1
Behavioral task
behavioral1
Sample
4d4de9714a1d888f6070d676363518ae.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4d4de9714a1d888f6070d676363518ae.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 4d4de9714a1d888f6070d676363518ae.exe
- Size 265KB
- Sample220714-hr4t8aecd7
- SHA256 c4e4941b22293175166737686128c2fa6c51781f1434253df4e0624ecf96a802
- MD5 4d4de9714a1d888f6070d676363518ae
- SHA1 14b8151cc8c38d16a177aaeb3e633b8c68b41ad3
- SHA512 cda06c66360448f1a21de72c0e10dd011e75b8945d1cf759dc69aa14124132a824b136dc092c79cf4fc3fa6a628bd0e858cb525bb7a0762a38d40ee179f7dc1d
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4d4de9714a1d888f6070d676363518ae.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4d4de9714a1d888f6070d676363518ae.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4d4de9714a1d888f6070d676363518ae.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2392 4d4de9714a1d888f6070d676363518ae.exe 2392 4d4de9714a1d888f6070d676363518ae.exe 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found 3144 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3144 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2392 4d4de9714a1d888f6070d676363518ae.exe