Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
69ad1f78beb56226f07833ea2707ed4d8918f176605809814759d16b6cffdd35.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
69ad1f78beb56226f07833ea2707ed4d8918f176605809814759d16b6cffdd35.exe
Resource
win10v2004-20220901-en
General
-
Target
69ad1f78beb56226f07833ea2707ed4d8918f176605809814759d16b6cffdd35.exe
-
Size
690KB
-
MD5
ea29f892f63fb38daa76c893c60e1656
-
SHA1
b5c55fdea4f3394604aa208bc00bb483bb32fef7
-
SHA256
69ad1f78beb56226f07833ea2707ed4d8918f176605809814759d16b6cffdd35
-
SHA512
274b44c2d1cad2fc1c2dff8c6b752dc8e2b185dc919c42f957e096bce9a665dfbf38860fadc603dd6c8be8bdeeb2041029220d15ddda024984110f8468f0ec1c
-
SSDEEP
12288:ON7V0bGwCxJOUfqvV8WzMx7BZEsIE6Zr1pZyAtZmbdS8ygIqUM9fiKZmI:ON7npqviWzMxnE46ZtysmbdNQqUgKS
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4916-132-0x0000000000400000-0x00000000004D3000-memory.dmp upx behavioral2/memory/4916-133-0x0000000000400000-0x00000000004D3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
69ad1f78beb56226f07833ea2707ed4d8918f176605809814759d16b6cffdd35.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AS2014 = "C:\\ProgramData\\Vv396vsg\\Vv396vsg.exe" 69ad1f78beb56226f07833ea2707ed4d8918f176605809814759d16b6cffdd35.exe -
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
69ad1f78beb56226f07833ea2707ed4d8918f176605809814759d16b6cffdd35.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 69ad1f78beb56226f07833ea2707ed4d8918f176605809814759d16b6cffdd35.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName 69ad1f78beb56226f07833ea2707ed4d8918f176605809814759d16b6cffdd35.exe