6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca

General

Target

6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe
Size

257KB
MD5

9261aa58bcd8ad089bd83906ab3178b0
SHA1

605d61c063842fdf2991669934a3cfb3d686de7f
SHA256

6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca
SHA512

2d014f05ae9cb409088d3ebf5e06a8adf5634fd1ac0e083e54380637b9e89dcdcf04c35c0f92fe94a8620780573b2bb52e4f4924214d2634a407b28291d349a5
SSDEEP

6144:WkCfvkfXIN0OMAORtIatBMmlRmJOPF9lgXZq:Wtvt0OMD5BngXY

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msiexec.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\661698053 = "C:\\ProgramData\\msaeub.exe"	msiexec.exe

Blocklisted process makes network request 7 IoCs

flow	pid	Process
1	1736	msiexec.exe
3	1736	msiexec.exe
4	1736	msiexec.exe
5	1736	msiexec.exe
7	1736	msiexec.exe
9	1736	msiexec.exe
10	1736	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Deletes itself 1 IoCs

pid	Process
1736	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\Run	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe
1736	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe
1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1736	1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe	27
PID 1636 wrote to memory of 1736	1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe	27
PID 1636 wrote to memory of 1736	1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe	27
PID 1636 wrote to memory of 1736	1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe	27
PID 1636 wrote to memory of 1736	1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe	27
PID 1636 wrote to memory of 1736	1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe	27
PID 1636 wrote to memory of 1736	1636	6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe	27

C:\Users\Admin\AppData\Local\Temp\6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe
"C:\Users\Admin\AppData\Local\Temp\6ffba1421d7e805b0416ceb480c4e43861463624c5c9085d1c1643287d86a0ca.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Adds policy Run key to start application
  - Blocklisted process makes network request
  - Deletes itself
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-54-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1636-55-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1636-56-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download
memory/1736-60-0x0000000000090000-0x0000000000095000-memory.dmp

Filesize
20KB

Download
memory/1736-59-0x0000000000790000-0x00000000007A4000-memory.dmp

Filesize
80KB

Download
memory/1736-61-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download
memory/1736-62-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads