Analysis
-
max time kernel
151s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 06:12
Static task
static1
Behavioral task
behavioral1
Sample
bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe
-
Size
334KB
-
MD5
9e1dc1d0d50e7d2442cf0f944b87867a
-
SHA1
8b7a67e5033da871e2b2282404cb86cc25dd6d0b
-
SHA256
bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2
-
SHA512
1e300be90ab26f78fe65fe9f8bb7ef60693869f57136ecdd2aa6cd89771a2b105da1fb4abfcea71e45b02fb414fd25b79c1290ce7c076de55c76f295fa878faf
-
SSDEEP
6144:mDrHEfWKiOZJurNSNxyRr/zx4F48I/sY0fvUZ30goB6PfSK:mDrHEfDYY3yRzzxx/SC66
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2040-56-0x0000000000400000-0x000000000046E000-memory.dmp upx behavioral1/memory/2040-57-0x0000000000400000-0x000000000046E000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe 2040 bd339e533350ab7bf2a247cbde7bcb6c5e6d9e0f7d1e07c446b5ddee5fab3ee2.exe