Analysis
-
max time kernel
159s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 06:18
Static task
static1
Behavioral task
behavioral1
Sample
87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe
-
Size
495KB
-
MD5
c472da73fb773ce02b9d3ce040c5dd9d
-
SHA1
1e445771c7529473be8ce71235949959ed5bb48b
-
SHA256
87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a
-
SHA512
862553352a7f6d9b5b4274e597070806604c2ea72d0c6367c706112b5a4aa506f3869f4024ccddc2da6ee438cc6c6046f57102bd8a5836ebc86f764c4ae7a2e3
-
SSDEEP
12288:GWIU4UzpDJLbArJuEz+Wj9aiMmvXLYLbZyz:Jz2daN7Y7+4
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3528-132-0x0000000000400000-0x0000000000503000-memory.dmp upx behavioral2/memory/3528-133-0x0000000000400000-0x0000000000503000-memory.dmp upx behavioral2/memory/3528-134-0x0000000000400000-0x0000000000503000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AS2014 = "C:\\ProgramData\\67xs9D77\\67xs9D77.exe" 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe -
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe 3528 87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe"C:\Users\Admin\AppData\Local\Temp\87478a4bf92e82d7ed01ccb8cf903c574fd618b3476fec05c26980722c4d279a.exe"1⤵
- Adds Run key to start application
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3528