7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196

General

Target

7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe
Size

54KB
MD5

168a567becc93d97ccbad039fcb62fd0
SHA1

1c08777da31abb978404d461569aad091e2af323
SHA256

7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196
SHA512

a7e492bd2ad707335fca3bfc095601f96667549899ffe27d5ee025916355632f11c931ec79783858036475c4ea0ba9c7124ccd9757c07c952028f0bff1eac20b
SSDEEP

1536:6Uf67S7QIkNCIcABdfe/gZ5ikT2i8iy4kcHC:6LSsNC94f+gZ0C8iy4kcHC

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msiexec.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1996471568 = "C:\\ProgramData\\msrufhv.exe"	msiexec.exe

Blocklisted process makes network request 10 IoCs

flow	pid	Process
2	900	msiexec.exe
3	900	msiexec.exe
5	900	msiexec.exe
6	900	msiexec.exe
10	900	msiexec.exe
11	900	msiexec.exe
12	900	msiexec.exe
13	900	msiexec.exe
14	900	msiexec.exe
15	900	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Deletes itself 1 IoCs

pid	Process
900	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\Run	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe
900	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe
2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 900	2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe	27
PID 2032 wrote to memory of 900	2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe	27
PID 2032 wrote to memory of 900	2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe	27
PID 2032 wrote to memory of 900	2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe	27
PID 2032 wrote to memory of 900	2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe	27
PID 2032 wrote to memory of 900	2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe	27
PID 2032 wrote to memory of 900	2032	7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe	27

C:\Users\Admin\AppData\Local\Temp\7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe
"C:\Users\Admin\AppData\Local\Temp\7b6769cd3a5abcb23b6ec494c2c7e854cf173a1392785b7919a71506d9120196.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Adds policy Run key to start application
  - Blocklisted process makes network request
  - Deletes itself
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-59-0x0000000000EB0000-0x0000000000EC4000-memory.dmp

Filesize
80KB

Download
memory/900-60-0x0000000000090000-0x0000000000096000-memory.dmp

Filesize
24KB

Download
memory/900-61-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download
memory/900-62-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download
memory/2032-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2032-57-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2032-58-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads