Analysis
- max time kernel
150s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
13/08/2022, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
748f88b9bbc6351a5eaba08f719b9d97.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
748f88b9bbc6351a5eaba08f719b9d97.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 748f88b9bbc6351a5eaba08f719b9d97.exe
- Size 230KB
- Sample220813-m989wabfd8
- SHA256 b7af7cbc443ea19e72c77741acce54a09cddfcc1ab58caa23d03bad6b3c1c128
- MD5 748f88b9bbc6351a5eaba08f719b9d97
- SHA1 0f924e8b8e7d80098a6b2d0056e95c688e08b3d4
- SHA512 9edddbfe0c4d0b75a3eef7f1ff7ecdd5829123dee5c59be28a3c023d2e1a2827eac0dc8c812fc6f4f5e6d0e0f7a646053be7dcd39b984111c7fc2bd0fbf8e879
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3536 set thread context of 3912 3536 748f88b9bbc6351a5eaba08f719b9d97.exe 79 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 748f88b9bbc6351a5eaba08f719b9d97.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 748f88b9bbc6351a5eaba08f719b9d97.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 748f88b9bbc6351a5eaba08f719b9d97.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3912 748f88b9bbc6351a5eaba08f719b9d97.exe 3912 748f88b9bbc6351a5eaba08f719b9d97.exe 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found 916 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 916 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3912 748f88b9bbc6351a5eaba08f719b9d97.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3536 wrote to memory of 3912 3536 748f88b9bbc6351a5eaba08f719b9d97.exe 79 PID 3536 wrote to memory of 3912 3536 748f88b9bbc6351a5eaba08f719b9d97.exe 79 PID 3536 wrote to memory of 3912 3536 748f88b9bbc6351a5eaba08f719b9d97.exe 79 PID 3536 wrote to memory of 3912 3536 748f88b9bbc6351a5eaba08f719b9d97.exe 79 PID 3536 wrote to memory of 3912 3536 748f88b9bbc6351a5eaba08f719b9d97.exe 79 PID 3536 wrote to memory of 3912 3536 748f88b9bbc6351a5eaba08f719b9d97.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\748f88b9bbc6351a5eaba08f719b9d97.exe"C:\Users\Admin\AppData\Local\Temp\748f88b9bbc6351a5eaba08f719b9d97.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\748f88b9bbc6351a5eaba08f719b9d97.exe"C:\Users\Admin\AppData\Local\Temp\748f88b9bbc6351a5eaba08f719b9d97.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3912
-