Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2022 11:56
Static task
static1
Behavioral task
behavioral1
Sample
a8ef2558341a5ca8ac58ee543e260ee4.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
a8ef2558341a5ca8ac58ee543e260ee4.exe
Resource
win10v2004-20220721-en
General
-
Target
a8ef2558341a5ca8ac58ee543e260ee4.exe
-
Size
182KB
-
MD5
a8ef2558341a5ca8ac58ee543e260ee4
-
SHA1
5585cc5f17f424639dae06d6feba403c78232f6a
-
SHA256
19e29cc8b874c3dd5fa4b724fb6d5d51db0b7c2fd4e954bb7b1dda228b2225fb
-
SHA512
be08f6166668cf30bd6817dda34a9184c36dcc446ad0b60da4c6426157071af97a57c99a233cf27df4627135916f082637671e36ca6381a4cf99c5cb12374d6a
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a8ef2558341a5ca8ac58ee543e260ee4.exedescription pid process target process PID 1464 set thread context of 3308 1464 a8ef2558341a5ca8ac58ee543e260ee4.exe a8ef2558341a5ca8ac58ee543e260ee4.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a8ef2558341a5ca8ac58ee543e260ee4.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a8ef2558341a5ca8ac58ee543e260ee4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a8ef2558341a5ca8ac58ee543e260ee4.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a8ef2558341a5ca8ac58ee543e260ee4.exe -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a8ef2558341a5ca8ac58ee543e260ee4.exepid process 3308 a8ef2558341a5ca8ac58ee543e260ee4.exe 3308 a8ef2558341a5ca8ac58ee543e260ee4.exe 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 2388 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2388 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a8ef2558341a5ca8ac58ee543e260ee4.exepid process 3308 a8ef2558341a5ca8ac58ee543e260ee4.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2388 Token: SeCreatePagefilePrivilege 2388 Token: SeShutdownPrivilege 2388 Token: SeCreatePagefilePrivilege 2388 Token: SeShutdownPrivilege 2388 Token: SeCreatePagefilePrivilege 2388 Token: SeShutdownPrivilege 2388 Token: SeCreatePagefilePrivilege 2388 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 2388 2388 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a8ef2558341a5ca8ac58ee543e260ee4.exedescription pid process target process PID 1464 wrote to memory of 3308 1464 a8ef2558341a5ca8ac58ee543e260ee4.exe a8ef2558341a5ca8ac58ee543e260ee4.exe PID 1464 wrote to memory of 3308 1464 a8ef2558341a5ca8ac58ee543e260ee4.exe a8ef2558341a5ca8ac58ee543e260ee4.exe PID 1464 wrote to memory of 3308 1464 a8ef2558341a5ca8ac58ee543e260ee4.exe a8ef2558341a5ca8ac58ee543e260ee4.exe PID 1464 wrote to memory of 3308 1464 a8ef2558341a5ca8ac58ee543e260ee4.exe a8ef2558341a5ca8ac58ee543e260ee4.exe PID 1464 wrote to memory of 3308 1464 a8ef2558341a5ca8ac58ee543e260ee4.exe a8ef2558341a5ca8ac58ee543e260ee4.exe PID 1464 wrote to memory of 3308 1464 a8ef2558341a5ca8ac58ee543e260ee4.exe a8ef2558341a5ca8ac58ee543e260ee4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8ef2558341a5ca8ac58ee543e260ee4.exe"C:\Users\Admin\AppData\Local\Temp\a8ef2558341a5ca8ac58ee543e260ee4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a8ef2558341a5ca8ac58ee543e260ee4.exe"C:\Users\Admin\AppData\Local\Temp\a8ef2558341a5ca8ac58ee543e260ee4.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1464-132-0x0000000002748000-0x0000000002759000-memory.dmpFilesize
68KB
-
memory/1464-133-0x0000000002640000-0x0000000002649000-memory.dmpFilesize
36KB
-
memory/3308-130-0x0000000000000000-mapping.dmp
-
memory/3308-131-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3308-134-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3308-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB