Analysis
-
max time kernel
265s -
max time network
335s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30/11/2022, 23:39
Static task
static1
Behavioral task
behavioral1
Sample
a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe
-
Size
340KB
-
MD5
4f90fec0ba133ccf7723db276e92c9be
-
SHA1
a12ad558d12378c40bf6107d1a58a911e243c77c
-
SHA256
a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b
-
SHA512
5537dce03aa152a9f6c470af80b4ed596a54dc4c8085146e1353f7f208aa24ece0f55179f28a79798c904a1a8bf38d6811c13793b1f666d73079efc9ed8ed810
-
SSDEEP
6144:vdKSzo0i3V0fee8+4zKbiOSkdSBkMrhAOVJtRY+M23ss798Z3AGt06+I2Q7dFgz0:VKSzNOjOSk0NN9TYzU9uzrUEP
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/572-56-0x0000000000400000-0x0000000000471000-memory.dmp upx behavioral1/memory/572-57-0x0000000000400000-0x0000000000471000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe 572 a98154d98598e1effaaeb2acbed34e4c8bc4e409a9744f21f6f231ed80c2f75b.exe