Analysis
- max time kernel
150s - max time network
48s - platform
windows7_x64 - resource
win7-20220414-en - submitted
15/07/2022, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
6206b5fd4a594971cb2dfd54acb5812f.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6206b5fd4a594971cb2dfd54acb5812f.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 6206b5fd4a594971cb2dfd54acb5812f.exe
- Size 322KB
- Sample220715-d642badcan
- SHA256 d45c0b79f446e702f1cc3cdd54dbf2cecbe6757941ea9b2707458e1c0334d7ec
- MD5 6206b5fd4a594971cb2dfd54acb5812f
- SHA1 9ba58ede1db8c4ea2921fdb570ea16ee0a0a5b0f
- SHA512 915451af41b5069cf47109c8c15cdd1ab112f3b9acdc0246eaea84cdd6ff4e62e63f8c63548492f9a918d813059b7e73c787d4cef56fd871df85039120b1e846
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1668 set thread context of 824 1668 6206b5fd4a594971cb2dfd54acb5812f.exe 28 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6206b5fd4a594971cb2dfd54acb5812f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6206b5fd4a594971cb2dfd54acb5812f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6206b5fd4a594971cb2dfd54acb5812f.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 824 6206b5fd4a594971cb2dfd54acb5812f.exe 824 6206b5fd4a594971cb2dfd54acb5812f.exe 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 824 6206b5fd4a594971cb2dfd54acb5812f.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1668 wrote to memory of 824 1668 6206b5fd4a594971cb2dfd54acb5812f.exe 28 PID 1668 wrote to memory of 824 1668 6206b5fd4a594971cb2dfd54acb5812f.exe 28 PID 1668 wrote to memory of 824 1668 6206b5fd4a594971cb2dfd54acb5812f.exe 28 PID 1668 wrote to memory of 824 1668 6206b5fd4a594971cb2dfd54acb5812f.exe 28 PID 1668 wrote to memory of 824 1668 6206b5fd4a594971cb2dfd54acb5812f.exe 28 PID 1668 wrote to memory of 824 1668 6206b5fd4a594971cb2dfd54acb5812f.exe 28 PID 1668 wrote to memory of 824 1668 6206b5fd4a594971cb2dfd54acb5812f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6206b5fd4a594971cb2dfd54acb5812f.exe"C:\Users\Admin\AppData\Local\Temp\6206b5fd4a594971cb2dfd54acb5812f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6206b5fd4a594971cb2dfd54acb5812f.exe"C:\Users\Admin\AppData\Local\Temp\6206b5fd4a594971cb2dfd54acb5812f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:824
-