Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 01:28
Static task
static1
Behavioral task
behavioral1
Sample
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe
Resource
win10v2004-20220812-en
General
-
Target
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe
-
Size
432KB
-
MD5
06ece60287a232151640da8dc799c29f
-
SHA1
a4478d9bb1e6c68b1993970e8c12683d21872e14
-
SHA256
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b
-
SHA512
d1e859fb8fd21c2d9fd88fdf5aaa2ad537492b13ff55ad08a52ccabbe834fec3b5446adfb30c8cc9356860601dcaa3ee5a3a471cb4f9b6e82c8401d6170f1486
-
SSDEEP
12288:paTsPzUmKT0Jv5Bq/k7Y9ysILBP5guci/46:gTsLMTHp9ysILBK9a4
Malware Config
Signatures
-
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe -
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe -
Disables taskbar notifications via registry modification
-
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\CEF7B5F593CD60120000CEF6E70364CA = "C:\\ProgramData\\CEF7B5F593CD60120000CEF6E70364CA\\CEF7B5F593CD60120000CEF6E70364CA.exe" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe -
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exepid process 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exepid process 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exepid process 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exepid process 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe 1612 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe"C:\Users\Admin\AppData\Local\Temp\2aa745abe16818a2c4eb3d63e5ad7ad89cdf83cc8f2c73aab871bafc03015f7b.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1612-54-0x00000000004E0000-0x00000000004E9000-memory.dmpFilesize
36KB
-
memory/1612-55-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1612-56-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB
-
memory/1612-57-0x00000000004F0000-0x00000000004F3000-memory.dmpFilesize
12KB
-
memory/1612-58-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB