3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0

Analysis

max time kernel
151s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2022 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
Size

312KB
MD5

72bd27cf772ec63fae7d3b0ab1d8d4f1
SHA1

66c36f770e28b79d58290d63269dbb1717dc9885
SHA256

3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0
SHA512

5b142230def237fcb77a1bda37ec6793552b3935f4e639cfd358279ab1ad16946d1cea69a9a377e6235732d7c34cb58bc3bf0ee2966c205eb84749fc486c9884

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe

description	pid	process	target process
PID 4336 set thread context of 2676	4336	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe

pid	process
2676	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
2676	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928
2928

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2928
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe

pid process

2676 3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe

pid	process
2928

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe

description	pid	process	target process
PID 4336 wrote to memory of 2676	4336	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
PID 4336 wrote to memory of 2676	4336	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
PID 4336 wrote to memory of 2676	4336	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
PID 4336 wrote to memory of 2676	4336	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
PID 4336 wrote to memory of 2676	4336	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
PID 4336 wrote to memory of 2676	4336	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe	3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe

C:\Users\Admin\AppData\Local\Temp\3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
"C:\Users\Admin\AppData\Local\Temp\3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4336

C:\Users\Admin\AppData\Local\Temp\3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe
"C:\Users\Admin\AppData\Local\Temp\3b3713db87053b6bb8e9b4f540fa837a0a7dbdc5e5fc0b73f01eae5d993a8bd0.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-134-0x0000000000000000-mapping.dmp

Download
memory/2676-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2676-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2676-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4336-132-0x000000000064E000-0x000000000065E000-memory.dmp

Filesize
64KB

Download
memory/4336-133-0x0000000000600000-0x0000000000609000-memory.dmp

Filesize
36KB

Download
memory/4336-136-0x000000000064E000-0x000000000065E000-memory.dmp

Filesize
64KB

Download