Analysis
-
max time kernel
49s -
max time network
179s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
03-10-2022 03:59
Static task
static1
Behavioral task
behavioral1
Sample
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
Resource
win10-20220901-en
General
-
Target
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
-
Size
141KB
-
MD5
048281c0731edf101f02abb1b69a2226
-
SHA1
a6ea5595847d3cbc13c3728c284357bf52a1b945
-
SHA256
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0
-
SHA512
285e6d46f073c8b2aeb67bc938ebf20829cf383961c564a7a5258bcc3bdb66a163ce15c9cc6400ed4a501bf6195e2699f96baa840bcf628f8b94d6b51de6fc85
-
SSDEEP
3072:VNRIUQ7gJGR4AVYZ0Ictpyt28+nqlBB01Qs3wsE:Cg7AVy0Imo8vwsE
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exepid process 328 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe 328 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe 328 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exedescription pid process Token: SeShutdownPrivilege 328 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Token: SeCreatePagefilePrivilege 328 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe"C:\Users\Admin\AppData\Local\Temp\ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/328-120-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-121-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-122-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-123-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-124-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-125-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-126-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-127-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-128-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-129-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-130-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-131-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-132-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-133-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-134-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-135-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-136-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-137-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-138-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-139-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-140-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-142-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-143-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-144-0x0000000000580000-0x000000000062E000-memory.dmpFilesize
696KB
-
memory/328-145-0x00000000022A0000-0x00000000022B2000-memory.dmpFilesize
72KB
-
memory/328-146-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-147-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-148-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-149-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-150-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-151-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-152-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/328-153-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-154-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-155-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-156-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-157-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-158-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-159-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-160-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-161-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-162-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-163-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-164-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-165-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-166-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-167-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-168-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-169-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-170-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-171-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-172-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-173-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-174-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-175-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-177-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-178-0x000000007FE90000-0x000000007FEA5000-memory.dmpFilesize
84KB
-
memory/328-176-0x0000000003020000-0x00000000030E0000-memory.dmpFilesize
768KB
-
memory/328-179-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-180-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-181-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-182-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-186-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-187-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-189-0x00000000036A0000-0x00000000046A0000-memory.dmpFilesize
16.0MB
-
memory/328-190-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-188-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/328-192-0x00000000022A0000-0x00000000022B2000-memory.dmpFilesize
72KB
-
memory/328-193-0x000000007FE90000-0x000000007FEA5000-memory.dmpFilesize
84KB
-
memory/328-194-0x000000007FE70000-0x000000007FE85000-memory.dmpFilesize
84KB