Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system - submitted
02/08/2022, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
54C873A361CED5BEED24A19E89464D5764BF22038B6E1.exe
Resource
win7-20220715-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
54C873A361CED5BEED24A19E89464D5764BF22038B6E1.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 54C873A361CED5BEED24A19E89464D5764BF22038B6E1.exe
- Size 280KB
- Sample220802-xpr5zabddn
- SHA256 54c873a361ced5beed24a19e89464d5764bf22038b6e149a49d24d992eadf7e8
- MD5 0631501507083f8dcac518ebfdb9fd17
- SHA1 6354901e6271f2a1cee65ec69a708e818ebae735
- SHA512 d5038c349544a9d8115bda2a839a1c8d5e261fc13e17b949439f2d8c94ac2a8d75932731f4dde1be2d92ad309eb900314c1ede4a1e712f61a05f32efa3de34da
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 54C873A361CED5BEED24A19E89464D5764BF22038B6E1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 54C873A361CED5BEED24A19E89464D5764BF22038B6E1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 54C873A361CED5BEED24A19E89464D5764BF22038B6E1.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3324 54C873A361CED5BEED24A19E89464D5764BF22038B6E1.exe 3324 54C873A361CED5BEED24A19E89464D5764BF22038B6E1.exe 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1204 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3324 54C873A361CED5BEED24A19E89464D5764BF22038B6E1.exe