Analysis
-
max time kernel
314s -
max time network
334s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03-10-2022 04:47
Static task
static1
Behavioral task
behavioral1
Sample
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
Resource
win10-20220812-en
General
-
Target
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
-
Size
141KB
-
MD5
048281c0731edf101f02abb1b69a2226
-
SHA1
a6ea5595847d3cbc13c3728c284357bf52a1b945
-
SHA256
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0
-
SHA512
285e6d46f073c8b2aeb67bc938ebf20829cf383961c564a7a5258bcc3bdb66a163ce15c9cc6400ed4a501bf6195e2699f96baa840bcf628f8b94d6b51de6fc85
-
SSDEEP
3072:VNRIUQ7gJGR4AVYZ0Ictpyt28+nqlBB01Qs3wsE:Cg7AVy0Imo8vwsE
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exepid process 2500 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe 2500 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe 2500 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exedescription pid process Token: SeShutdownPrivilege 2500 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe Token: SeCreatePagefilePrivilege 2500 ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe"C:\Users\Admin\AppData\Local\Temp\ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2500-115-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-116-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-117-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-118-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-119-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-120-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-121-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-122-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-123-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-124-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-125-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-127-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-126-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-128-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-129-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-130-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-131-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-132-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-133-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-134-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-135-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-137-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-138-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-139-0x0000000000680000-0x00000000007CA000-memory.dmpFilesize
1.3MB
-
memory/2500-140-0x0000000000680000-0x00000000007CA000-memory.dmpFilesize
1.3MB
-
memory/2500-141-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-142-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-143-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-144-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-145-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-146-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-147-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/2500-148-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-149-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-150-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-151-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-152-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-153-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-154-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-155-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-156-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-157-0x0000000000680000-0x00000000007CA000-memory.dmpFilesize
1.3MB
-
memory/2500-158-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-159-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-160-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-161-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-162-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-163-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-164-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-165-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-166-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-167-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-168-0x0000000003020000-0x00000000030DE000-memory.dmpFilesize
760KB
-
memory/2500-169-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-170-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-171-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-172-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-173-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-174-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-175-0x000000007FE90000-0x000000007FEA5000-memory.dmpFilesize
84KB
-
memory/2500-176-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-177-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-178-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-180-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-182-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-183-0x00000000036A0000-0x00000000046A0000-memory.dmpFilesize
16.0MB
-
memory/2500-184-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-185-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-186-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2500-188-0x000000007FE90000-0x000000007FEA5000-memory.dmpFilesize
84KB
-
memory/2500-189-0x000000007FE70000-0x000000007FE85000-memory.dmpFilesize
84KB