Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 02:30

General

  • Target

    a97b292397865c0e2ef228b3e245d2eec0bd167fb75f267d7ee9b46d0057f2d9.exe

  • Size

    523KB

  • MD5

    5b641ac1f5f1c6eecb56c6910f59df07

  • SHA1

    cd0eb5b1c1cda52c4b74b22cb995558fd4fe1fe4

  • SHA256

    a97b292397865c0e2ef228b3e245d2eec0bd167fb75f267d7ee9b46d0057f2d9

  • SHA512

    29535fd3963b92ec5ac3b0d8eee1179e5d8415b241a9ea01f51c58eee824c297bd9356c6067c3388d67f7fb328c47be5902113e61ea49be8d2518f6258eceb02

  • SSDEEP

    12288:6Om/nK06mwh82duMZqF1QU83G4io8XHUijRql:t4IvdVwgJGHUiFG

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a97b292397865c0e2ef228b3e245d2eec0bd167fb75f267d7ee9b46d0057f2d9.exe
    "C:\Users\Admin\AppData\Local\Temp\a97b292397865c0e2ef228b3e245d2eec0bd167fb75f267d7ee9b46d0057f2d9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Users\Admin\AppData\Local\Temp\a97b292397865c0e2ef228b3e245d2eec0bd167fb75f267d7ee9b46d0057f2d9.exe
      C:\Users\Admin\AppData\Local\Temp\a97b292397865c0e2ef228b3e245d2eec0bd167fb75f267d7ee9b46d0057f2d9.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:544
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        3⤵
          PID:4868
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:3112
          • C:\Users\Admin\AppData\Local\Temp\a97b292397865c0e2ef228b3e245d2eec0bd167fb75f267d7ee9b46d0057f2d9.exe
            C:\Users\Admin\AppData\Local\Temp\a97b292397865c0e2ef228b3e245d2eec0bd167fb75f267d7ee9b46d0057f2d9.exe
            3⤵
            • Modifies Installed Components in the registry
            • Adds Run key to start application
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            PID:3544

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/544-135-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/544-137-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/544-136-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/544-152-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/544-147-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/3544-158-0x00000000102CA000-0x000000001031B000-memory.dmp

              Filesize

              324KB

            • memory/3544-157-0x0000000010001000-0x00000000102CA000-memory.dmp

              Filesize

              2.8MB

            • memory/3544-156-0x00000000102CA000-0x000000001031B000-memory.dmp

              Filesize

              324KB

            • memory/3544-159-0x0000000010001000-0x00000000102CA000-memory.dmp

              Filesize

              2.8MB

            • memory/3544-153-0x0000000010000000-0x000000001031C000-memory.dmp

              Filesize

              3.1MB

            • memory/3544-155-0x0000000010000000-0x000000001031C000-memory.dmp

              Filesize

              3.1MB

            • memory/3544-154-0x0000000010000000-0x000000001031C000-memory.dmp

              Filesize

              3.1MB

            • memory/4868-141-0x0000000010000000-0x000000001031C000-memory.dmp

              Filesize

              3.1MB

            • memory/4868-140-0x0000000010000000-0x000000001031C000-memory.dmp

              Filesize

              3.1MB

            • memory/4868-139-0x0000000010000000-0x000000001031C000-memory.dmp

              Filesize

              3.1MB