Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:38
Static task
static1
Behavioral task
behavioral1
Sample
32597fef3858d407645f9a79f35861f80eeec12c0b8dbc20bb3ef6b583e0c747.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
32597fef3858d407645f9a79f35861f80eeec12c0b8dbc20bb3ef6b583e0c747.exe
Resource
win10v2004-20221111-en
General
-
Target
32597fef3858d407645f9a79f35861f80eeec12c0b8dbc20bb3ef6b583e0c747.exe
-
Size
504KB
-
MD5
f77c20e721317dc42bdf715c800ae1b2
-
SHA1
b08b3931069020d4e55b1ac36c340a88a900a4cd
-
SHA256
32597fef3858d407645f9a79f35861f80eeec12c0b8dbc20bb3ef6b583e0c747
-
SHA512
292cf6b84bbcd74665186f61f987c16ed72d07bac3122c568b0c99ac5773965a8a0893a8d97a8471429e827c3711ae4ccd8ff43cafa92ac36434fb1a168ac788
-
SSDEEP
12288:B298RDZERwRx3cSpeanHZFi3z7xWv7yhpCL+QSSE:BrRDlspanHZozrbRK
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4580-133-0x0000000000400000-0x0000000000510000-memory.dmp upx behavioral2/memory/4580-134-0x0000000000400000-0x0000000000510000-memory.dmp upx behavioral2/memory/4580-135-0x0000000000400000-0x0000000000510000-memory.dmp upx behavioral2/memory/4580-136-0x0000000000400000-0x0000000000510000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
32597fef3858d407645f9a79f35861f80eeec12c0b8dbc20bb3ef6b583e0c747.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AS2014 = "C:\\ProgramData\\hVd7WnUg\\hVd7WnUg.exe" 32597fef3858d407645f9a79f35861f80eeec12c0b8dbc20bb3ef6b583e0c747.exe -
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
32597fef3858d407645f9a79f35861f80eeec12c0b8dbc20bb3ef6b583e0c747.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 32597fef3858d407645f9a79f35861f80eeec12c0b8dbc20bb3ef6b583e0c747.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName 32597fef3858d407645f9a79f35861f80eeec12c0b8dbc20bb3ef6b583e0c747.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4580-132-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/4580-133-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/4580-134-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/4580-135-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/4580-136-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB