Analysis
-
max time kernel
146s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-09-2022 17:26
Static task
static1
Behavioral task
behavioral1
Sample
dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe
-
Size
400KB
-
MD5
31dbe5c604fc96f713af5aeb29381923
-
SHA1
5ccde773247f4a7bbbdb9198c80ab4ac9ef6eeb5
-
SHA256
dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb
-
SHA512
e29295bf09ab31768724d058388ebbe3003b7d73cc8b852bd50f044981923b16f8e52705c5eb69a6ecafb9c3d135c9b7c513da4a2eb2699d9ae2e4a9a1e89f60
-
SSDEEP
12288:YuXCKDOdtG8vbI9JeFDWd9y1OomZ4ZQvLm:YuXBDcE8vbg0AzZuoL
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000CA680B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000CA680B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000CA680B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000CA680B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000CA680B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1444 F4D55F6500014973000CA680B4EB2331.exe -
Deletes itself 1 IoCs
pid Process 1444 F4D55F6500014973000CA680B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000CA680B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000CA680B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000CA680B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000CA680B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000CA680B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000CA680B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000CA680B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce F4D55F6500014973000CA680B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000CA680B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000CA680B4EB2331\\F4D55F6500014973000CA680B4EB2331.exe" F4D55F6500014973000CA680B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe 1444 F4D55F6500014973000CA680B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 860 wrote to memory of 1444 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 27 PID 860 wrote to memory of 1444 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 27 PID 860 wrote to memory of 1444 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 27 PID 860 wrote to memory of 1444 860 dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe"C:\Users\Admin\AppData\Local\Temp\dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\ProgramData\F4D55F6500014973000CA680B4EB2331\F4D55F6500014973000CA680B4EB2331.exe"C:\ProgramData\F4D55F6500014973000CA680B4EB2331\F4D55F6500014973000CA680B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1444
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400KB
MD531dbe5c604fc96f713af5aeb29381923
SHA15ccde773247f4a7bbbdb9198c80ab4ac9ef6eeb5
SHA256dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb
SHA512e29295bf09ab31768724d058388ebbe3003b7d73cc8b852bd50f044981923b16f8e52705c5eb69a6ecafb9c3d135c9b7c513da4a2eb2699d9ae2e4a9a1e89f60
-
Filesize
400KB
MD531dbe5c604fc96f713af5aeb29381923
SHA15ccde773247f4a7bbbdb9198c80ab4ac9ef6eeb5
SHA256dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb
SHA512e29295bf09ab31768724d058388ebbe3003b7d73cc8b852bd50f044981923b16f8e52705c5eb69a6ecafb9c3d135c9b7c513da4a2eb2699d9ae2e4a9a1e89f60
-
Filesize
400KB
MD531dbe5c604fc96f713af5aeb29381923
SHA15ccde773247f4a7bbbdb9198c80ab4ac9ef6eeb5
SHA256dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb
SHA512e29295bf09ab31768724d058388ebbe3003b7d73cc8b852bd50f044981923b16f8e52705c5eb69a6ecafb9c3d135c9b7c513da4a2eb2699d9ae2e4a9a1e89f60
-
Filesize
400KB
MD531dbe5c604fc96f713af5aeb29381923
SHA15ccde773247f4a7bbbdb9198c80ab4ac9ef6eeb5
SHA256dcd71ceff40224b7c119b6a30aacc5c1d2dd532790829472885b8c1b6e6acafb
SHA512e29295bf09ab31768724d058388ebbe3003b7d73cc8b852bd50f044981923b16f8e52705c5eb69a6ecafb9c3d135c9b7c513da4a2eb2699d9ae2e4a9a1e89f60