Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
03-08-2022 15:06
Static task
static1
Behavioral task
behavioral1
Sample
c529659ad79b58eb83d1732b6cc88ff5.exe
Resource
win7-20220718-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c529659ad79b58eb83d1732b6cc88ff5.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
c529659ad79b58eb83d1732b6cc88ff5.exe
-
Size
182KB
-
MD5
c529659ad79b58eb83d1732b6cc88ff5
-
SHA1
aad399bd653192ec0ecdeac5c1a4cbf43afb19b6
-
SHA256
269200ba6acb859b712185ebdad2b0000333e42d194e05d12d86eb3590125aed
-
SHA512
6e81a8a8803746e0c10b8a18ec7a1061efc8bd6eabbbbab4e02b0a01b21c360b1a73fb93b0a8d40961f309ae915f214a03f0e6a49024e6a000de24fb906ca3d6
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c529659ad79b58eb83d1732b6cc88ff5.exedescription pid process target process PID 1140 set thread context of 1008 1140 c529659ad79b58eb83d1732b6cc88ff5.exe c529659ad79b58eb83d1732b6cc88ff5.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c529659ad79b58eb83d1732b6cc88ff5.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c529659ad79b58eb83d1732b6cc88ff5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c529659ad79b58eb83d1732b6cc88ff5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c529659ad79b58eb83d1732b6cc88ff5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c529659ad79b58eb83d1732b6cc88ff5.exepid process 1008 c529659ad79b58eb83d1732b6cc88ff5.exe 1008 c529659ad79b58eb83d1732b6cc88ff5.exe 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c529659ad79b58eb83d1732b6cc88ff5.exepid process 1008 c529659ad79b58eb83d1732b6cc88ff5.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
c529659ad79b58eb83d1732b6cc88ff5.exedescription pid process target process PID 1140 wrote to memory of 1008 1140 c529659ad79b58eb83d1732b6cc88ff5.exe c529659ad79b58eb83d1732b6cc88ff5.exe PID 1140 wrote to memory of 1008 1140 c529659ad79b58eb83d1732b6cc88ff5.exe c529659ad79b58eb83d1732b6cc88ff5.exe PID 1140 wrote to memory of 1008 1140 c529659ad79b58eb83d1732b6cc88ff5.exe c529659ad79b58eb83d1732b6cc88ff5.exe PID 1140 wrote to memory of 1008 1140 c529659ad79b58eb83d1732b6cc88ff5.exe c529659ad79b58eb83d1732b6cc88ff5.exe PID 1140 wrote to memory of 1008 1140 c529659ad79b58eb83d1732b6cc88ff5.exe c529659ad79b58eb83d1732b6cc88ff5.exe PID 1140 wrote to memory of 1008 1140 c529659ad79b58eb83d1732b6cc88ff5.exe c529659ad79b58eb83d1732b6cc88ff5.exe PID 1140 wrote to memory of 1008 1140 c529659ad79b58eb83d1732b6cc88ff5.exe c529659ad79b58eb83d1732b6cc88ff5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c529659ad79b58eb83d1732b6cc88ff5.exe"C:\Users\Admin\AppData\Local\Temp\c529659ad79b58eb83d1732b6cc88ff5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c529659ad79b58eb83d1732b6cc88ff5.exe"C:\Users\Admin\AppData\Local\Temp\c529659ad79b58eb83d1732b6cc88ff5.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1008-54-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1008-55-0x0000000000402DD8-mapping.dmp
-
memory/1008-57-0x0000000074D61000-0x0000000074D63000-memory.dmpFilesize
8KB
-
memory/1008-59-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1008-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1140-58-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/1140-56-0x000000000030B000-0x000000000031C000-memory.dmpFilesize
68KB