5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa

General

Target

5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
Size

150KB
MD5

723187d38995646085285544130142d0
SHA1

3d5e478e2420e682198cc4f460f437170a6321ee
SHA256

5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa
SHA512

40845fb7b2f8cf5c20695e0b423b4d791a247f8b368065adab201d461cfdb12e80e0697f4aef38a00dfa0fd996aafa1c99647009e1915ec2279abbaf6d5da1bc
SSDEEP

3072:2w7GSzESqFXLo0X2/qe5gJ2Vnc5vww/TSUjinkSQ4GZm:RqSzxqFKy4VwIAobGM

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\4007177512 = "C:\\PROGRA~3\\msknxrjg.exe"	msiexec.exe

Blocklisted process makes network request 12 IoCs

flow	pid	Process
2	1488	msiexec.exe
3	1488	msiexec.exe
4	1488	msiexec.exe
5	1488	msiexec.exe
7	1488	msiexec.exe
8	1488	msiexec.exe
9	1488	msiexec.exe
10	1488	msiexec.exe
11	1488	msiexec.exe
12	1488	msiexec.exe
13	1488	msiexec.exe
14	1488	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Deletes itself 1 IoCs

pid	Process
1488	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 620 set thread context of 1312	620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	27

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~3\msknxrjg.exe	msiexec.exe
File created	C:\PROGRA~3\msknxrjg.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
1488	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
Token: SeBackupPrivilege	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
Token: SeRestorePrivilege	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
Token: SeDebugPrivilege	1488	msiexec.exe
Token: SeBackupPrivilege	1488	msiexec.exe
Token: SeRestorePrivilege	1488	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1312	620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	27
PID 620 wrote to memory of 1312	620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	27
PID 620 wrote to memory of 1312	620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	27
PID 620 wrote to memory of 1312	620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	27
PID 620 wrote to memory of 1312	620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	27
PID 620 wrote to memory of 1312	620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	27
PID 620 wrote to memory of 1312	620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	27
PID 620 wrote to memory of 1312	620	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	27
PID 1312 wrote to memory of 1488	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	28
PID 1312 wrote to memory of 1488	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	28
PID 1312 wrote to memory of 1488	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	28
PID 1312 wrote to memory of 1488	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	28
PID 1312 wrote to memory of 1488	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	28
PID 1312 wrote to memory of 1488	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	28
PID 1312 wrote to memory of 1488	1312	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	28

C:\Users\Admin\AppData\Local\Temp\5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
"C:\Users\Admin\AppData\Local\Temp\5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:620
- C:\Users\Admin\AppData\Local\Temp\5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
  "C:\Users\Admin\AppData\Local\Temp\5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\msiexec.exe
    3⤵
    - UAC bypass
    - Adds policy Run key to start application
    - Blocklisted process makes network request
    - Deletes itself
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-60-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/1312-54-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1312-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1312-56-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1312-58-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1312-61-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1312-64-0x000000007EF90000-0x000000007EF95000-memory.dmp

Filesize
20KB

Download
memory/1488-65-0x0000000000E20000-0x0000000000E34000-memory.dmp

Filesize
80KB

Download
memory/1488-66-0x000000007EF90000-0x000000007EF95000-memory.dmp

Filesize
20KB

Download
memory/1488-67-0x000000007EF90000-0x000000007EF95000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads