Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe
-
Size
39KB
-
MD5
147d1815934156b79f1082b296161672
-
SHA1
c35ec95c7bb6e14d3f805981c3882e3a592ebd94
-
SHA256
750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55
-
SHA512
652d72ea177fdc26982152f7c73b673eecb7271e1f95551ddc4ede9cc7f56ceb9ac562692f24febd5d365ee95dd4be7744a863ec0f867b6552e515b44cbe404f
-
SSDEEP
192:jZKLlGmjLaQmKJqBlJlk/mC+NnDBjT8A5cGwn7rE3tp0gkgcv6FzYteJL1K1vUwm:jZSlGALaJHZDBjD5cG/3Itd+zEmLQ1v
Score
6/10
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2268 set thread context of 4108 2268 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 80 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 4108 2268 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 80 PID 2268 wrote to memory of 4108 2268 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 80 PID 2268 wrote to memory of 4108 2268 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 80 PID 2268 wrote to memory of 4108 2268 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 80 PID 2268 wrote to memory of 4108 2268 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 80 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56 PID 4108 wrote to memory of 3036 4108 750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe"C:\Users\Admin\AppData\Local\Temp\750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exeC:\Users\Admin\AppData\Local\Temp\750aa6163ad7a433704d9c1aa3e752433f923f92946c6abb6437926e8ba28a55.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4108
-
-