Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b0939137b56861d30c02bf8c2a42f1c.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b0939137b56861d30c02bf8c2a42f1c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0b0939137b56861d30c02bf8c2a42f1c.exe
-
Size
1.7MB
-
MD5
0b0939137b56861d30c02bf8c2a42f1c
-
SHA1
3e8a26ed1653394676db7f104ea2d97b0053e160
-
SHA256
8175eb3085d209a982720c69d1880234ac26b58e90713eeebaa971c6ef195eb4
-
SHA512
4b39940c3a0c95273028e83bec80148a2957556dfd45527e24e750fa2d395b3b886ed22e295291330895475800f030238a8953f4926a0a8aba3f6409343a44b6
-
SSDEEP
24576:kgSivRpANHygPunq/n+uIMHvEJoAofl7giPK9AErPV/AHYc6Nw+geqapYP+VyoEz:k3SgbvhIq8CZg0pIDQ+oMFBCv7Z
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags 0b0939137b56861d30c02bf8c2a42f1c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 0b0939137b56861d30c02bf8c2a42f1c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags 0b0939137b56861d30c02bf8c2a42f1c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 0b0939137b56861d30c02bf8c2a42f1c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom 0b0939137b56861d30c02bf8c2a42f1c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 0b0939137b56861d30c02bf8c2a42f1c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom 0b0939137b56861d30c02bf8c2a42f1c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 0b0939137b56861d30c02bf8c2a42f1c.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe 3744 0b0939137b56861d30c02bf8c2a42f1c.exe