Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2022 17:04
Static task
static1
Behavioral task
behavioral1
Sample
3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe
-
Size
292KB
-
MD5
122f15275b0d2458eed1d470920cc102
-
SHA1
3e5c52e2b4227239da0734f520a47cead905bb7b
-
SHA256
3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad
-
SHA512
1319349fb5540f253f705d273749b481c487054e18a9f82d42aeff126d2266fb7a883d9f5e0854d3190d339840d74beb594332dd5399e6ca66c9ea76d761fbae
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exedescription pid process target process PID 1736 set thread context of 4360 1736 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exepid process 4360 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe 4360 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 676 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 676 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exepid process 4360 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exedescription pid process target process PID 1736 wrote to memory of 4360 1736 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe PID 1736 wrote to memory of 4360 1736 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe PID 1736 wrote to memory of 4360 1736 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe PID 1736 wrote to memory of 4360 1736 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe PID 1736 wrote to memory of 4360 1736 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe PID 1736 wrote to memory of 4360 1736 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe 3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe"C:\Users\Admin\AppData\Local\Temp\3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe"C:\Users\Admin\AppData\Local\Temp\3583f7afe751c36550f0822a0cb76cf6687988156cac590d80ae5830083844ad.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1736-132-0x000000000074D000-0x000000000075E000-memory.dmpFilesize
68KB
-
memory/1736-133-0x00000000005F0000-0x00000000005F9000-memory.dmpFilesize
36KB
-
memory/4360-130-0x0000000000000000-mapping.dmp
-
memory/4360-131-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4360-134-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4360-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB