Analysis
-
max time kernel
182s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 08:53
Static task
static1
Behavioral task
behavioral1
Sample
1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe
-
Size
416KB
-
MD5
83aa9b9d356df0a7f516dfe28f52bf5a
-
SHA1
682090a2c1c2f09dfb4cab5b41d48188cd1dbbb9
-
SHA256
1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736
-
SHA512
5e124bf52332169ca51e879aa03a5e0823a3c8c636068eb11a2cf41d7a68d1b55f272f59f7d4b5d8ab5eeca3a0a8d74e1cb65aaa23d5af1774f4203e27963eda
-
SSDEEP
6144:UEIZfVpT8JCsigkUMPwfmYK/gcqeAnAGJEG32oNL559JRiq7AxglF3C:UTN96CDgswKeeAnAmDzl3iq7p3
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B4090B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1648 F4D55F6500014973000B4090B4EB2331.exe -
Deletes itself 1 IoCs
pid Process 1648 F4D55F6500014973000B4090B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000B4090B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000B4090B4EB2331\\F4D55F6500014973000B4090B4EB2331.exe" F4D55F6500014973000B4090B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1648 F4D55F6500014973000B4090B4EB2331.exe 1648 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1648 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 27 PID 1284 wrote to memory of 1648 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 27 PID 1284 wrote to memory of 1648 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 27 PID 1284 wrote to memory of 1648 1284 1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe"C:\Users\Admin\AppData\Local\Temp\1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe"C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\1026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1648
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
416KB
MD583aa9b9d356df0a7f516dfe28f52bf5a
SHA1682090a2c1c2f09dfb4cab5b41d48188cd1dbbb9
SHA2561026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736
SHA5125e124bf52332169ca51e879aa03a5e0823a3c8c636068eb11a2cf41d7a68d1b55f272f59f7d4b5d8ab5eeca3a0a8d74e1cb65aaa23d5af1774f4203e27963eda
-
Filesize
416KB
MD583aa9b9d356df0a7f516dfe28f52bf5a
SHA1682090a2c1c2f09dfb4cab5b41d48188cd1dbbb9
SHA2561026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736
SHA5125e124bf52332169ca51e879aa03a5e0823a3c8c636068eb11a2cf41d7a68d1b55f272f59f7d4b5d8ab5eeca3a0a8d74e1cb65aaa23d5af1774f4203e27963eda
-
Filesize
416KB
MD583aa9b9d356df0a7f516dfe28f52bf5a
SHA1682090a2c1c2f09dfb4cab5b41d48188cd1dbbb9
SHA2561026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736
SHA5125e124bf52332169ca51e879aa03a5e0823a3c8c636068eb11a2cf41d7a68d1b55f272f59f7d4b5d8ab5eeca3a0a8d74e1cb65aaa23d5af1774f4203e27963eda
-
Filesize
416KB
MD583aa9b9d356df0a7f516dfe28f52bf5a
SHA1682090a2c1c2f09dfb4cab5b41d48188cd1dbbb9
SHA2561026f7dbca7615f05eac74c3bd0aa0a26422f847c86b033e67ee804e3c626736
SHA5125e124bf52332169ca51e879aa03a5e0823a3c8c636068eb11a2cf41d7a68d1b55f272f59f7d4b5d8ab5eeca3a0a8d74e1cb65aaa23d5af1774f4203e27963eda