Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 14:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bedc4073ec0e38ee8a9e2f04dcace561.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bedc4073ec0e38ee8a9e2f04dcace561.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
bedc4073ec0e38ee8a9e2f04dcace561.exe
-
Size
214KB
-
MD5
bedc4073ec0e38ee8a9e2f04dcace561
-
SHA1
8d95179f6be220cee5d482a53e999d8870a69f50
-
SHA256
e5c70f7cfb54d0bb0157eef3c98dca31e8ff2a183222c1fde8a13265b1613cf3
-
SHA512
fd895c4baea7ce165c6a3cc109d7fabc154fb60f3382a3ebb0ec55977cfc0231472222c96221990550b352910ec79b6aa984654836b96c9f2d12af5518019d04
-
SSDEEP
3072:b5hb9OE5yxOvWNB4g1PaL6ruDOP57XnRnYQqOGve8T7gt8F8vLqg1cw:TbDWNRgL3SxHqlmy7E8yvLqgyw
Score
6/10
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum bedc4073ec0e38ee8a9e2f04dcace561.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 bedc4073ec0e38ee8a9e2f04dcace561.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4436 set thread context of 4392 4436 bedc4073ec0e38ee8a9e2f04dcace561.exe 90 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe 4392 bedc4073ec0e38ee8a9e2f04dcace561.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4436 wrote to memory of 4392 4436 bedc4073ec0e38ee8a9e2f04dcace561.exe 90 PID 4436 wrote to memory of 4392 4436 bedc4073ec0e38ee8a9e2f04dcace561.exe 90 PID 4436 wrote to memory of 4392 4436 bedc4073ec0e38ee8a9e2f04dcace561.exe 90 PID 4436 wrote to memory of 4392 4436 bedc4073ec0e38ee8a9e2f04dcace561.exe 90 PID 4436 wrote to memory of 4392 4436 bedc4073ec0e38ee8a9e2f04dcace561.exe 90 PID 4436 wrote to memory of 4392 4436 bedc4073ec0e38ee8a9e2f04dcace561.exe 90 PID 4436 wrote to memory of 4392 4436 bedc4073ec0e38ee8a9e2f04dcace561.exe 90 PID 4436 wrote to memory of 4392 4436 bedc4073ec0e38ee8a9e2f04dcace561.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\bedc4073ec0e38ee8a9e2f04dcace561.exe"C:\Users\Admin\AppData\Local\Temp\bedc4073ec0e38ee8a9e2f04dcace561.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\bedc4073ec0e38ee8a9e2f04dcace561.exe"C:\Users\Admin\AppData\Local\Temp\bedc4073ec0e38ee8a9e2f04dcace561.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4392
-