b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4

General

Target

b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe
Size

291KB
MD5

9084e81c0b51b9993eee1d630291ce50
SHA1

1d9c6d2412cfa863b0c4bff24689d28b6216489a
SHA256

b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4
SHA512

7f0b18738823f65db4770cb7c3a732e59ae6564cdb00621a3a804ef87b397722e691b67d4c8d4fe8cdfb73528d4ac488576bede556fac6545ebef197a92f487e
SSDEEP

3072:TlIJyx7/BGAB0SKvLHjt7YSr89eHTXsUp+iWJXbrSRvyG9w+iWJf:5IJy9IA+Rt7zx0JXbavyG9fJf

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msiexec.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1879930181 = "C:\\ProgramData\\mssnuuvl.exe"	msiexec.exe

Blocklisted process makes network request 7 IoCs

flow	pid	Process
2	1572	msiexec.exe
3	1572	msiexec.exe
5	1572	msiexec.exe
6	1572	msiexec.exe
10	1572	msiexec.exe
12	1572	msiexec.exe
13	1572	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Deletes itself 1 IoCs

pid	Process
1572	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\software\microsoft\windows\currentversion\Run	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe
1572	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe
1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1572	1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe	28
PID 1652 wrote to memory of 1572	1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe	28
PID 1652 wrote to memory of 1572	1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe	28
PID 1652 wrote to memory of 1572	1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe	28
PID 1652 wrote to memory of 1572	1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe	28
PID 1652 wrote to memory of 1572	1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe	28
PID 1652 wrote to memory of 1572	1652	b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe	28

C:\Users\Admin\AppData\Local\Temp\b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe
"C:\Users\Admin\AppData\Local\Temp\b073fd2a007c791958dfd951a7e764a73d1c4579000988d9e3d63b6c7b6751e4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Adds policy Run key to start application
  - Blocklisted process makes network request
  - Deletes itself
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-59-0x0000000000D00000-0x0000000000D14000-memory.dmp

Filesize
80KB

Download
memory/1572-60-0x0000000000090000-0x0000000000096000-memory.dmp

Filesize
24KB

Download
memory/1572-61-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download
memory/1572-62-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download
memory/1652-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1652-58-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads