be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77

Analysis

max time kernel
186s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Size

76KB
MD5

5312226848c17088c650b2d3f6c89b2f
SHA1

f152eb35e0ac02326b316a78acf5c129c2e41b9c
SHA256

be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77
SHA512

a6cb92593b079bbf282e5e04e24c46033d302da083cad616855c0504e062de62873b50c8733a23d04ce5bb09678707495b6f298085b9815de91b09ef3f9b8ac6
SSDEEP

768:BembNRqsuhlGOBrhgFwumSCbxTGy/BBGg4NKJJKqUThbJ32+ve7i40vN0TlT+Xk+:3nqdu3abBGy3G8V0iuo2j

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	scnw.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	scnw.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	scnw.exe

Executes dropped EXE 1 IoCs

pid	Process
1660	scnw.exe

Loads dropped DLL 2 IoCs

pid	Process
1240	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
1240	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	scnw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	scnw.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	scnw.exe
File opened (read-only)	\??\X:	scnw.exe
File opened (read-only)	\??\L:	scnw.exe
File opened (read-only)	\??\Q:	scnw.exe
File opened (read-only)	\??\R:	scnw.exe
File opened (read-only)	\??\U:	scnw.exe
File opened (read-only)	\??\P:	scnw.exe
File opened (read-only)	\??\S:	scnw.exe
File opened (read-only)	\??\T:	scnw.exe
File opened (read-only)	\??\F:	scnw.exe
File opened (read-only)	\??\G:	scnw.exe
File opened (read-only)	\??\J:	scnw.exe
File opened (read-only)	\??\M:	scnw.exe
File opened (read-only)	\??\O:	scnw.exe
File opened (read-only)	\??\B:	scnw.exe
File opened (read-only)	\??\E:	scnw.exe
File opened (read-only)	\??\H:	scnw.exe
File opened (read-only)	\??\I:	scnw.exe
File opened (read-only)	\??\Z:	scnw.exe
File opened (read-only)	\??\K:	scnw.exe
File opened (read-only)	\??\N:	scnw.exe
File opened (read-only)	\??\W:	scnw.exe
File opened (read-only)	\??\Y:	scnw.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	scnw.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	scnw.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	scnw.exe
File created	\??\c:\windows\SysWOW64\maxtrox.txt	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	scnw.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	scnw.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	scnw.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	scnw.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	scnw.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	scnw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	scnw.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	scnw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	scnw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	scnw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	scnw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	scnw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	scnw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	scnw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1240	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
1660	scnw.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1660	1240	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe	28
PID 1240 wrote to memory of 1660	1240	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe	28
PID 1240 wrote to memory of 1660	1240	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe	28
PID 1240 wrote to memory of 1660	1240	be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe	28

C:\Users\Admin\AppData\Local\Temp\be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe
"C:\Users\Admin\AppData\Local\Temp\be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77.exe"
1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240
- \??\c:\Documents and Settings\Admin\Application Data\Microsoft\scnw.exe
  "c:\Documents and Settings\Admin\Application Data\Microsoft\scnw.exe" be7e6988d27a09db1b16a844d9b74b140279de9d2f6b459a2b53b6de410f5f77
  2⤵
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\scnw.exe

Filesize
76KB

MD5
c3766c14e12792b43e985800d572e059

SHA1
01ef5016cbb907e25c4fa0835ac959111c5c5138

SHA256
f388dff33f816b91144d2c0b2324562834b906a574683e5a9f831609722f0640

SHA512
b164e20c8869b605601bf381351501e8018344bbbaa6d6686d3a748e14b559985e5fe79c30520c9c78421532916a0a0d33a0c6e1f008f18a9b5075b04c1b7a05

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\scnw.exe

Filesize
76KB

MD5
c3766c14e12792b43e985800d572e059

SHA1
01ef5016cbb907e25c4fa0835ac959111c5c5138

SHA256
f388dff33f816b91144d2c0b2324562834b906a574683e5a9f831609722f0640

SHA512
b164e20c8869b605601bf381351501e8018344bbbaa6d6686d3a748e14b559985e5fe79c30520c9c78421532916a0a0d33a0c6e1f008f18a9b5075b04c1b7a05

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
20374257ec2775d0415663fb76842290

SHA1
1a6f3a9f52d23eb07faa640ef7f9d84d637f19fc

SHA256
a919460efb5353e51f2f3ebc58e757d66a1bb19bd796c9dab95a35e7c7520b9c

SHA512
4c9a2d39a8be98fbddf244db11893531de8caf0d13e5c704884def73ee75938adee7f8c8667ff30d40fcc8a6f0bc0e02a36a8ad7c176b5b310019795ba6cefd5

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\scnw.exe

Filesize
76KB

MD5
c3766c14e12792b43e985800d572e059

SHA1
01ef5016cbb907e25c4fa0835ac959111c5c5138

SHA256
f388dff33f816b91144d2c0b2324562834b906a574683e5a9f831609722f0640

SHA512
b164e20c8869b605601bf381351501e8018344bbbaa6d6686d3a748e14b559985e5fe79c30520c9c78421532916a0a0d33a0c6e1f008f18a9b5075b04c1b7a05

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\scnw.exe

Filesize
76KB

MD5
c3766c14e12792b43e985800d572e059

SHA1
01ef5016cbb907e25c4fa0835ac959111c5c5138

SHA256
f388dff33f816b91144d2c0b2324562834b906a574683e5a9f831609722f0640

SHA512
b164e20c8869b605601bf381351501e8018344bbbaa6d6686d3a748e14b559985e5fe79c30520c9c78421532916a0a0d33a0c6e1f008f18a9b5075b04c1b7a05

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads