Analysis
- max time kernel
150s - max time network
49s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
20/08/2022, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
eb59130bf288c166ef8f119bc5354c9a.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
eb59130bf288c166ef8f119bc5354c9a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target eb59130bf288c166ef8f119bc5354c9a.exe
- Size 219KB
- Sample220820-jptf5sbdf3
- SHA256 857b7f40ec30133e2bfce32910de053032fc5dc7146c2eb3c53c1e9d0e30262a
- MD5 eb59130bf288c166ef8f119bc5354c9a
- SHA1 7545c150b20c473469eaf1cbba55060d260c7f9b
- SHA512 ab044ba24f9ab32b26e209a04c09683e015ff35423535f04e419a469abfa1145cb1a3cba4755af6ccd42959251f7434640451cb71d74d3059bab4e11c34f19a4
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb59130bf288c166ef8f119bc5354c9a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb59130bf288c166ef8f119bc5354c9a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb59130bf288c166ef8f119bc5354c9a.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 740 eb59130bf288c166ef8f119bc5354c9a.exe 740 eb59130bf288c166ef8f119bc5354c9a.exe 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found 1404 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 740 eb59130bf288c166ef8f119bc5354c9a.exe