Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
03-08-2022 08:06
Static task
static1
Behavioral task
behavioral1
Sample
72ca6d6179572214160da9198d4dd496.exe
Resource
win7-20220718-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
72ca6d6179572214160da9198d4dd496.exe
Resource
win10v2004-20220722-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
72ca6d6179572214160da9198d4dd496.exe
-
Size
181KB
-
MD5
72ca6d6179572214160da9198d4dd496
-
SHA1
fbcd2b16d346c156f6083b0367b751df0a8d6503
-
SHA256
5a3d6d5164f3d0a89f158b542c683752ba6071799d1b375d0b74a643c2cf7618
-
SHA512
8930448f089d464a52c1a84c817112b45bfd895790c32f33b2f56e4e57b8b5ebb30533422e5bd3e8db9a7d8a3ce6e42f2cb0ae464c55dfd6c57bbdee3a74f0c9
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
72ca6d6179572214160da9198d4dd496.exedescription pid process target process PID 1892 set thread context of 1948 1892 72ca6d6179572214160da9198d4dd496.exe 72ca6d6179572214160da9198d4dd496.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
72ca6d6179572214160da9198d4dd496.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72ca6d6179572214160da9198d4dd496.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72ca6d6179572214160da9198d4dd496.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72ca6d6179572214160da9198d4dd496.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
72ca6d6179572214160da9198d4dd496.exepid process 1948 72ca6d6179572214160da9198d4dd496.exe 1948 72ca6d6179572214160da9198d4dd496.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
72ca6d6179572214160da9198d4dd496.exepid process 1948 72ca6d6179572214160da9198d4dd496.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
72ca6d6179572214160da9198d4dd496.exedescription pid process target process PID 1892 wrote to memory of 1948 1892 72ca6d6179572214160da9198d4dd496.exe 72ca6d6179572214160da9198d4dd496.exe PID 1892 wrote to memory of 1948 1892 72ca6d6179572214160da9198d4dd496.exe 72ca6d6179572214160da9198d4dd496.exe PID 1892 wrote to memory of 1948 1892 72ca6d6179572214160da9198d4dd496.exe 72ca6d6179572214160da9198d4dd496.exe PID 1892 wrote to memory of 1948 1892 72ca6d6179572214160da9198d4dd496.exe 72ca6d6179572214160da9198d4dd496.exe PID 1892 wrote to memory of 1948 1892 72ca6d6179572214160da9198d4dd496.exe 72ca6d6179572214160da9198d4dd496.exe PID 1892 wrote to memory of 1948 1892 72ca6d6179572214160da9198d4dd496.exe 72ca6d6179572214160da9198d4dd496.exe PID 1892 wrote to memory of 1948 1892 72ca6d6179572214160da9198d4dd496.exe 72ca6d6179572214160da9198d4dd496.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72ca6d6179572214160da9198d4dd496.exe"C:\Users\Admin\AppData\Local\Temp\72ca6d6179572214160da9198d4dd496.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\72ca6d6179572214160da9198d4dd496.exe"C:\Users\Admin\AppData\Local\Temp\72ca6d6179572214160da9198d4dd496.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1892-56-0x00000000025FB000-0x000000000260B000-memory.dmpFilesize
64KB
-
memory/1892-58-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1948-55-0x0000000000402DD8-mapping.dmp
-
memory/1948-54-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1948-57-0x0000000075CC1000-0x0000000075CC3000-memory.dmpFilesize
8KB
-
memory/1948-59-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1948-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB