Analysis
- max time kernel
146s - max time network
154s - platform
windows7_x64 - resource
win7 - submitted
30/08/2020, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
9a57ef7f5f2b6d8e22434b17c12492c6.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9a57ef7f5f2b6d8e22434b17c12492c6.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 9a57ef7f5f2b6d8e22434b17c12492c6.exe
- Size 13.9MB
- Sample200830-jflakesepa
- SHA256 edcff9440f08358abcd5d2dc9c2e3868891150d9b4b8819c3bf69eb41d89b6b7
- MD5 9a57ef7f5f2b6d8e22434b17c12492c6
- SHA1 49157293787c0cc5f7ece9daf037bd49b02406cb
- SHA512 f05013cebc8d97e512c14edb66d0d5c6dbf25a47bde85344cee3f1411ef3e61ff1b516b7e050ee660e6779a1fbe1bd230544f2aa3762182df5a35319afbea281
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 48 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir PersonalEdition Classic 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Eset\NOD 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\NOD 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BAVSvc 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS\Installer 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\AVAST Software\Avast 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast\Exchange 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir PersonalEdition Premium 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Eset\NOD\CurrentVersion\Info 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\a2AntiMalware 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Antivirus 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\K7 Computing\K7TotalSecurity 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Exchange 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Workstation 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir Desktop 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Bitdefender\QuickScan 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\FRISK Software\F-PROT Antivirus for Windows 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir PersonalEdition Classic 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir PersonalEdition Premium 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Antivirus 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir Workstation 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Premium Security Suite 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Premium Security Suite 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Server 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\AntiVirService 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\KasperskyLab 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir Server 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Security 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\NOD\CurrentVersion\Info 9a57ef7f5f2b6d8e22434b17c12492c6.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 9a57ef7f5f2b6d8e22434b17c12492c6.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1156 9a57ef7f5f2b6d8e22434b17c12492c6.exe 1156 9a57ef7f5f2b6d8e22434b17c12492c6.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1156 9a57ef7f5f2b6d8e22434b17c12492c6.exe 1156 9a57ef7f5f2b6d8e22434b17c12492c6.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1156 9a57ef7f5f2b6d8e22434b17c12492c6.exe 1156 9a57ef7f5f2b6d8e22434b17c12492c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a57ef7f5f2b6d8e22434b17c12492c6.exe"C:\Users\Admin\AppData\Local\Temp\9a57ef7f5f2b6d8e22434b17c12492c6.exe"1⤵
- Checks for any installed AV software in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1156