Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
22/08/2022, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
79fa6b039a907adc4dc189053d9e43b6.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
79fa6b039a907adc4dc189053d9e43b6.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 79fa6b039a907adc4dc189053d9e43b6.exe
- Size 264KB
- Sample220822-wrfdhsbdeq
- SHA256 33af215a4961e94293b0bc1d463df44c0ffb63416057acf5f620cff0ea434ddb
- MD5 79fa6b039a907adc4dc189053d9e43b6
- SHA1 827026df0f1d0741ff3b9d214921d4e4ef8ffa35
- SHA512 262b8b08314f281653c08da172292d0e4c9fc8c7e44cc156ef9269821732ee537e9e4d21d8004521516fcfc0a744942cb4de8d19f0293c6b3d454f7df7d4dc76
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4460 gahddgb - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fa6b039a907adc4dc189053d9e43b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gahddgb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gahddgb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gahddgb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fa6b039a907adc4dc189053d9e43b6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fa6b039a907adc4dc189053d9e43b6.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4352 79fa6b039a907adc4dc189053d9e43b6.exe 4352 79fa6b039a907adc4dc189053d9e43b6.exe 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3064 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4352 79fa6b039a907adc4dc189053d9e43b6.exe 4460 gahddgb
Processes
-
C:\Users\Admin\AppData\Local\Temp\79fa6b039a907adc4dc189053d9e43b6.exe"C:\Users\Admin\AppData\Local\Temp\79fa6b039a907adc4dc189053d9e43b6.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4352
-
C:\Users\Admin\AppData\Roaming\gahddgbC:\Users\Admin\AppData\Roaming\gahddgb1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4460
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\gahddgb
- Size 264KB
- SHA256 33af215a4961e94293b0bc1d463df44c0ffb63416057acf5f620cff0ea434ddb
- MD5 79fa6b039a907adc4dc189053d9e43b6
- SHA1 827026df0f1d0741ff3b9d214921d4e4ef8ffa35
- SHA512 262b8b08314f281653c08da172292d0e4c9fc8c7e44cc156ef9269821732ee537e9e4d21d8004521516fcfc0a744942cb4de8d19f0293c6b3d454f7df7d4dc76
- SSDEEP 6144:f9mXaCY3cO2gChilRC3068LESiuxUYkbLnfExes:VmtYsO2gChiu30685RxUYCfd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\gahddgb
- Size 264KB
- SHA256 33af215a4961e94293b0bc1d463df44c0ffb63416057acf5f620cff0ea434ddb
- MD5 79fa6b039a907adc4dc189053d9e43b6
- SHA1 827026df0f1d0741ff3b9d214921d4e4ef8ffa35
- SHA512 262b8b08314f281653c08da172292d0e4c9fc8c7e44cc156ef9269821732ee537e9e4d21d8004521516fcfc0a744942cb4de8d19f0293c6b3d454f7df7d4dc76
- SSDEEP 6144:f9mXaCY3cO2gChilRC3068LESiuxUYkbLnfExes:VmtYsO2gChiu30685RxUYCfd
- MD5 SHA1 SHA512 SSDEEP