Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system - submitted
23/07/2022, 03:52
Static task
static1
Behavioral task
behavioral1
Sample
91f13635445661db987a4c3ece7d1cce.exe
Resource
win7-20220718-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
91f13635445661db987a4c3ece7d1cce.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91f13635445661db987a4c3ece7d1cce.exe
- Size 291KB
- Sample220723-ee283sbhc4
- SHA256 331d8343af5408c6b41ba24ba6d86f4d448429f63abcfb15e412856a3b2db758
- MD5 91f13635445661db987a4c3ece7d1cce
- SHA1 52759b0f219b8076a3f42f793daf3584266c5701
- SHA512 12e1c9bccf9e823e45fddf58b8a7c13234960117fd043ab70f9f01bd6431a33ce83266539b4032496414751752572fccdbf81bde4a2bc752e34bb163e18a2a1f
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3136 set thread context of 4472 3136 91f13635445661db987a4c3ece7d1cce.exe 78 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 91f13635445661db987a4c3ece7d1cce.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 91f13635445661db987a4c3ece7d1cce.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 91f13635445661db987a4c3ece7d1cce.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4472 91f13635445661db987a4c3ece7d1cce.exe 4472 91f13635445661db987a4c3ece7d1cce.exe 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found 2232 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2232 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4472 91f13635445661db987a4c3ece7d1cce.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4472 3136 91f13635445661db987a4c3ece7d1cce.exe 78 PID 3136 wrote to memory of 4472 3136 91f13635445661db987a4c3ece7d1cce.exe 78 PID 3136 wrote to memory of 4472 3136 91f13635445661db987a4c3ece7d1cce.exe 78 PID 3136 wrote to memory of 4472 3136 91f13635445661db987a4c3ece7d1cce.exe 78 PID 3136 wrote to memory of 4472 3136 91f13635445661db987a4c3ece7d1cce.exe 78 PID 3136 wrote to memory of 4472 3136 91f13635445661db987a4c3ece7d1cce.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\91f13635445661db987a4c3ece7d1cce.exe"C:\Users\Admin\AppData\Local\Temp\91f13635445661db987a4c3ece7d1cce.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\91f13635445661db987a4c3ece7d1cce.exe"C:\Users\Admin\AppData\Local\Temp\91f13635445661db987a4c3ece7d1cce.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4472
-