Analysis
- max time kernel
151s - max time network
44s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
04/08/2022, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
4ae642b458eefdcfff7d6fa2ffc71452.exe
Resource
win7-20220718-en
windows7-x64
3 signatures
150 seconds
General
- Target 4ae642b458eefdcfff7d6fa2ffc71452.exe
- Size 195KB
- Sample220804-bc8fjaaccn
- SHA256 823cc32c034672805f39c8cffbadbdd8614bb3886dbcd4cb8c8f68bd5e49d1f4
- MD5 4ae642b458eefdcfff7d6fa2ffc71452
- SHA1 8d33eea4389d83bea42cb359bc784ad734da3097
- SHA512 6807024ecc96f1aad6d6c54db439996f6e1fad411cf42e4be9fc8c1b75466e5570dcadb7d071132baab3a2994e1495d9e34567d14728051bc94695d84bd8397d
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4ae642b458eefdcfff7d6fa2ffc71452.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4ae642b458eefdcfff7d6fa2ffc71452.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4ae642b458eefdcfff7d6fa2ffc71452.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1876 4ae642b458eefdcfff7d6fa2ffc71452.exe 1876 4ae642b458eefdcfff7d6fa2ffc71452.exe 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1876 4ae642b458eefdcfff7d6fa2ffc71452.exe