Analysis
-
max time kernel
4s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:30
Static task
static1
Behavioral task
behavioral1
Sample
ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe
-
Size
268KB
-
MD5
36f02627ee715c9702f3f805c812a6b0
-
SHA1
4c14dd22888a1696bca4477cbfa5e259f36783ee
-
SHA256
ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626
-
SHA512
51f6deaa1083528fc1e6eaaf7164ca813a86872b019bae9e679daa42ba62935b82b76c14fa7d926ed2dad5d94d0c6228fa27389c35b323dc91fb612883ef24f5
-
SSDEEP
1536:HyD+ZGicBzyRWfeH7Ddzvjij6uPK8weLjAEoH1SnR0L+D8HhkhGoEdB203nM6Oyh:SDacBBfeH7s6uPwSR0Lo8+oldA03z5h
Score
6/10
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1964 set thread context of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 PID 1964 wrote to memory of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 PID 1964 wrote to memory of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 PID 1964 wrote to memory of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 PID 1964 wrote to memory of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 PID 1964 wrote to memory of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 PID 1964 wrote to memory of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 PID 1964 wrote to memory of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 PID 1964 wrote to memory of 1956 1964 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 28 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16 PID 1956 wrote to memory of 1212 1956 ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe 16
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe"C:\Users\Admin\AppData\Local\Temp\ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe"C:\Users\Admin\AppData\Local\Temp\ba4fcfd3df1a3ae8201b5dbfaf9c9d725e7d31ffff35e1a0d50b22f5be2fe626.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1956
-
-