Analysis
-
max time kernel
1792s -
max time network
1232s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
29/05/2023, 21:43
General
-
Target
SDIO_x64_R753.exe
-
Size
5.1MB
-
MD5
bcc820cda8a2cd2484ff08ac36ef5116
-
SHA1
258bb2c6b1065f4bb48e3bc2baf11a89a1c8aa11
-
SHA256
63997f17b27c19e6a1dfb77b68e475baab78961999b668bf0401f2a9b5a5e028
-
SHA512
d83714ca2cba13b992f3d76d8622dbd1c3e305b4e98e51072bbd6d9f245f155b0361a2e9c47b8ac0a0b6e8c164266944550648992e45220adfee1c9243bba424
-
SSDEEP
49152:wi4fH9oFEftw3vYMkqecOCiQhxOsEzijUeukxEqtH+Nn1YufNaUYl5beRfbtG6NC:XQh3M9F1OmhdSEeRfbtrPb78n
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 6 IoCs
-
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SDIO_x64_R753.exe"C:\Users\Admin\AppData\Local\Temp\SDIO_x64_R753.exe"1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
-
Filesize
5.3MB