Analysis
- max time kernel
150s - max time network
45s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
22/08/2022, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
79fa6b039a907adc4dc189053d9e43b6.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
79fa6b039a907adc4dc189053d9e43b6.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 79fa6b039a907adc4dc189053d9e43b6.exe
- Size 264KB
- Sample220822-wrfdhsbdeq
- SHA256 33af215a4961e94293b0bc1d463df44c0ffb63416057acf5f620cff0ea434ddb
- MD5 79fa6b039a907adc4dc189053d9e43b6
- SHA1 827026df0f1d0741ff3b9d214921d4e4ef8ffa35
- SHA512 262b8b08314f281653c08da172292d0e4c9fc8c7e44cc156ef9269821732ee537e9e4d21d8004521516fcfc0a744942cb4de8d19f0293c6b3d454f7df7d4dc76
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fa6b039a907adc4dc189053d9e43b6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fa6b039a907adc4dc189053d9e43b6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fa6b039a907adc4dc189053d9e43b6.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2036 79fa6b039a907adc4dc189053d9e43b6.exe 2036 79fa6b039a907adc4dc189053d9e43b6.exe 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2036 79fa6b039a907adc4dc189053d9e43b6.exe