Analysis
- max time kernel
150s - max time network
48s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
24/08/2022, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
9b8e0207c5999fc422743c642e618dc2.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b8e0207c5999fc422743c642e618dc2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 9b8e0207c5999fc422743c642e618dc2.exe
- Size 184KB
- Sample220824-skk4msgbd9
- SHA256 a180c8a4da34d47b2d787d9d1a7e6d75fd969afc708780331fb746d41b26e2cd
- MD5 9b8e0207c5999fc422743c642e618dc2
- SHA1 762e0dc571912d0ee25d634df31010a8795b26bd
- SHA512 7859435be5e9da4377a9bc82f2d9eb54e2c2ee5cbb68b2e3d1c7809f5c7285a7b8340af9cb8ee209ff7be40879877aa3f0d667ab9093079b10acfb9cc02245fc
- SSDEEP 3072:YEf6UTGX2GOByMhiGS/ufDnAhrui9LFfm9CkAQ7wfssxkgaBChY:j6+GX2GOXhBS/KmruqLF6DAQ8higa
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9b8e0207c5999fc422743c642e618dc2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9b8e0207c5999fc422743c642e618dc2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9b8e0207c5999fc422743c642e618dc2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 9b8e0207c5999fc422743c642e618dc2.exe 1980 9b8e0207c5999fc422743c642e618dc2.exe 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found 1416 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1980 9b8e0207c5999fc422743c642e618dc2.exe