Analysis
-
max time kernel
142s -
max time network
88s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:57
Static task
static1
Behavioral task
behavioral1
Sample
ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe
Resource
win10v2004-20220812-en
General
-
Target
ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe
-
Size
364KB
-
MD5
a4cd8e69a1b0bb1f47260135eaaa63df
-
SHA1
f67a9f8ed907f1dbf6c63701911dfe24f9cf5ebe
-
SHA256
ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3
-
SHA512
9841fd1fbbc423b0484ec6b019ed97294680b6c1e380b79ef893d1a1906f5e914d6823cad10f1011c0266cd0302c553d06ae276e65c14c2841638b0de1fd6611
-
SSDEEP
6144:Iy2ljyXMFWRPs8OW452Q0H2DjOnJm6Zy/ZPAQ9gBf:L2lKMFOkbV5f0H2DeJxZaZPJ+
Malware Config
Signatures
-
Processes:
ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exeF4D55F6500014973000CE10CB4EB2331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1268 F4D55F6500014973000CE10CB4EB2331.exe -
Deletes itself 1 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1268 F4D55F6500014973000CE10CB4EB2331.exe -
Loads dropped DLL 2 IoCs
Processes:
ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exepid process 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe -
Processes:
ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exeF4D55F6500014973000CE10CB4EB2331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000CE10CB4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000CE10CB4EB2331 = "C:\\ProgramData\\F4D55F6500014973000CE10CB4EB2331\\F4D55F6500014973000CE10CB4EB2331.exe" F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exeF4D55F6500014973000CE10CB4EB2331.exepid process 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1268 F4D55F6500014973000CE10CB4EB2331.exe 1268 F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exedescription pid process target process PID 2032 wrote to memory of 1268 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe F4D55F6500014973000CE10CB4EB2331.exe PID 2032 wrote to memory of 1268 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe F4D55F6500014973000CE10CB4EB2331.exe PID 2032 wrote to memory of 1268 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe F4D55F6500014973000CE10CB4EB2331.exe PID 2032 wrote to memory of 1268 2032 ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe F4D55F6500014973000CE10CB4EB2331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe"C:\Users\Admin\AppData\Local\Temp\ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe"C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exeFilesize
364KB
MD5a4cd8e69a1b0bb1f47260135eaaa63df
SHA1f67a9f8ed907f1dbf6c63701911dfe24f9cf5ebe
SHA256ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3
SHA5129841fd1fbbc423b0484ec6b019ed97294680b6c1e380b79ef893d1a1906f5e914d6823cad10f1011c0266cd0302c553d06ae276e65c14c2841638b0de1fd6611
-
C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exeFilesize
364KB
MD5a4cd8e69a1b0bb1f47260135eaaa63df
SHA1f67a9f8ed907f1dbf6c63701911dfe24f9cf5ebe
SHA256ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3
SHA5129841fd1fbbc423b0484ec6b019ed97294680b6c1e380b79ef893d1a1906f5e914d6823cad10f1011c0266cd0302c553d06ae276e65c14c2841638b0de1fd6611
-
\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exeFilesize
364KB
MD5a4cd8e69a1b0bb1f47260135eaaa63df
SHA1f67a9f8ed907f1dbf6c63701911dfe24f9cf5ebe
SHA256ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3
SHA5129841fd1fbbc423b0484ec6b019ed97294680b6c1e380b79ef893d1a1906f5e914d6823cad10f1011c0266cd0302c553d06ae276e65c14c2841638b0de1fd6611
-
\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exeFilesize
364KB
MD5a4cd8e69a1b0bb1f47260135eaaa63df
SHA1f67a9f8ed907f1dbf6c63701911dfe24f9cf5ebe
SHA256ee0cc993162c8284ca36e04284a57da1635b67dcbd4c2c6b52ba4bdee97919d3
SHA5129841fd1fbbc423b0484ec6b019ed97294680b6c1e380b79ef893d1a1906f5e914d6823cad10f1011c0266cd0302c553d06ae276e65c14c2841638b0de1fd6611
-
memory/1268-62-0x0000000000000000-mapping.dmp
-
memory/1268-65-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/1268-69-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/1268-70-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/2032-59-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/2032-54-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/2032-58-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/2032-57-0x0000000076B51000-0x0000000076B53000-memory.dmpFilesize
8KB
-
memory/2032-56-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/2032-71-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB