Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
12-08-2022 17:03
Static task
static1
Behavioral task
behavioral1
Sample
f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe
Resource
win10-20220812-en
General
-
Target
f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe
-
Size
292KB
-
MD5
741dce7015b532196ab8d29eae574292
-
SHA1
087d9d01bf22f199862c40671715afb21ed9f013
-
SHA256
f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014
-
SHA512
d4395af4f6fb7522960df584ff41b4573b3beb8f8559d84b2f157e39c8dbd30f582778fb4898f292156f26a1e25fa2d8a38d19b200caee2fe5061be8cba6f7c7
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
pid process 2076 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exedescription pid process target process PID 3516 set thread context of 1752 3516 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exepid process 1752 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe 1752 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 2076 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2076 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exepid process 1752 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exedescription pid process target process PID 3516 wrote to memory of 1752 3516 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe PID 3516 wrote to memory of 1752 3516 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe PID 3516 wrote to memory of 1752 3516 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe PID 3516 wrote to memory of 1752 3516 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe PID 3516 wrote to memory of 1752 3516 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe PID 3516 wrote to memory of 1752 3516 f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe"C:\Users\Admin\AppData\Local\Temp\f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe"C:\Users\Admin\AppData\Local\Temp\f86c57cd5b4c5dca74a4bb88e24335d480c4bade5e26b6be273019b9788c5014.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1752-161-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-164-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-179-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1752-178-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-147-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1752-176-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-175-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-174-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-173-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-172-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-170-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-171-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-169-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-149-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-168-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-167-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-166-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-165-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-163-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-162-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-160-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-159-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-158-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1752-157-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-156-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-155-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-154-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-153-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-152-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-151-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-148-0x0000000000402DD8-mapping.dmp
-
memory/1752-177-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/1752-150-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-118-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-146-0x0000000000470000-0x000000000051E000-memory.dmpFilesize
696KB
-
memory/3516-129-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-145-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-143-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-142-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-141-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-140-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-138-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-137-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-136-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-135-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-116-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-144-0x0000000000540000-0x000000000068A000-memory.dmpFilesize
1.3MB
-
memory/3516-117-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-134-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-132-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-131-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-130-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-128-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-127-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-126-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-125-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-124-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-123-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-122-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-121-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-120-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-119-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-133-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB