e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3

General

Target

e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Size

1.4MB
MD5

62edd2fe67b09624278be62d8e6d02e3
SHA1

463ff58415bb1a4a32606e5775b48faceeaae7f7
SHA256

e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3
SHA512

686bff5efeb939ecc85768a6cbe5b5ddcb299ea8349ce0bd104e5f6bf34ecca5459cf5efa67759d546960bea06bac30cb777e75b59186d3f5a533f6a50d22efd
SSDEEP

24576:kLiTQ6+lX2hOZC5zbQ3VB9IQB9h85jJRh0RVOojPIz4J2vejW1XLaclp6Lvhx6wV:kYEWqKzbQ3/p9hcJRhEAaI12vhx6wV1p

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4336	4104	WerFault.exe	75

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4104	e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe

C:\Users\Admin\AppData\Local\Temp\e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe
"C:\Users\Admin\AppData\Local\Temp\e5e3a8a79f5d94cf3653932e942ce03e02145060328a0c82f0049c5f558b9dd3.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 276
  2⤵
  - Program crash
  PID:4336