Analysis
-
max time kernel
150s -
max time network
71s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-01-2023 10:31
Static task
static1
Behavioral task
behavioral1
Sample
fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe
Resource
win10-20220812-en
General
-
Target
fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe
-
Size
341KB
-
MD5
250973815ae5ccaa0b928d111effe1d7
-
SHA1
5e4f54161514a0c089e5f4d7e90cffb06bb8fbaa
-
SHA256
fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c
-
SHA512
ed54d84220a580f6b70df08308d89f5c272d9b1d9eb941f98228129f557fc168784fa7299c50a39dfcabd09b0753f163edb56844a5a505546251006e7cb07252
-
SSDEEP
6144:uL32eg3D58Dw69VFutShtnzOjq7VWRFBMolz9095m:ur2x3in9VFuSHt7VWR5lz5
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
pid process 2364 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exepid process 2832 fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe 2832 fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2364 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exepid process 2832 fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe"C:\Users\Admin\AppData\Local\Temp\fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2832-115-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-116-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-117-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-118-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-119-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-120-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-121-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-122-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-123-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-124-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-125-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-126-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-127-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-128-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-130-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-131-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-132-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-134-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-135-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-136-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-137-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-138-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-133-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-129-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-140-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-141-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-142-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-143-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-144-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-145-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-146-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-147-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-149-0x0000000000460000-0x000000000050E000-memory.dmpFilesize
696KB
-
memory/2832-148-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-150-0x0000000000460000-0x000000000050E000-memory.dmpFilesize
696KB
-
memory/2832-152-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/2832-151-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-153-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB