Analysis
-
max time kernel
215s -
max time network
305s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:57
Static task
static1
Behavioral task
behavioral1
Sample
1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe
Resource
win10v2004-20220812-en
General
-
Target
1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe
-
Size
364KB
-
MD5
891cc4ad6d04f29c301b62f5b12ab56c
-
SHA1
3ffdb2f7bf0d7ae0101680d11b2b5fdc3010cbfc
-
SHA256
1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97
-
SHA512
8e2922a47ec9d8f33a0416b585a545ef66edfc281c8222b988adf5fa60e957c0d5b9f5e0d0fde5790cf9c44661d6b24007b7dc0982a2c998423a118ca776ba4e
-
SSDEEP
6144:YhC3IkyXMFWRPs8OW452Q0H2DjOnJm6Zy/ZPAQ9gBf:YFMFOkbV5f0H2DeJxZaZPJ+
Malware Config
Signatures
-
Processes:
F4D55F6500014973000C4E45B4EB2331.exe1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C4E45B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
F4D55F6500014973000C4E45B4EB2331.exepid process 1156 F4D55F6500014973000C4E45B4EB2331.exe -
Loads dropped DLL 2 IoCs
Processes:
1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exepid process 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe -
Processes:
1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exeF4D55F6500014973000C4E45B4EB2331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C4E45B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
F4D55F6500014973000C4E45B4EB2331.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000C4E45B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000C4E45B4EB2331\\F4D55F6500014973000C4E45B4EB2331.exe" F4D55F6500014973000C4E45B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exeF4D55F6500014973000C4E45B4EB2331.exepid process 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe 1156 F4D55F6500014973000C4E45B4EB2331.exe 1156 F4D55F6500014973000C4E45B4EB2331.exe 1156 F4D55F6500014973000C4E45B4EB2331.exe 1156 F4D55F6500014973000C4E45B4EB2331.exe 1156 F4D55F6500014973000C4E45B4EB2331.exe 1156 F4D55F6500014973000C4E45B4EB2331.exe 1156 F4D55F6500014973000C4E45B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exedescription pid process target process PID 1164 wrote to memory of 1156 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe F4D55F6500014973000C4E45B4EB2331.exe PID 1164 wrote to memory of 1156 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe F4D55F6500014973000C4E45B4EB2331.exe PID 1164 wrote to memory of 1156 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe F4D55F6500014973000C4E45B4EB2331.exe PID 1164 wrote to memory of 1156 1164 1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe F4D55F6500014973000C4E45B4EB2331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe"C:\Users\Admin\AppData\Local\Temp\1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe"C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\1a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exeFilesize
364KB
MD5891cc4ad6d04f29c301b62f5b12ab56c
SHA13ffdb2f7bf0d7ae0101680d11b2b5fdc3010cbfc
SHA2561a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97
SHA5128e2922a47ec9d8f33a0416b585a545ef66edfc281c8222b988adf5fa60e957c0d5b9f5e0d0fde5790cf9c44661d6b24007b7dc0982a2c998423a118ca776ba4e
-
C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exeFilesize
364KB
MD5891cc4ad6d04f29c301b62f5b12ab56c
SHA13ffdb2f7bf0d7ae0101680d11b2b5fdc3010cbfc
SHA2561a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97
SHA5128e2922a47ec9d8f33a0416b585a545ef66edfc281c8222b988adf5fa60e957c0d5b9f5e0d0fde5790cf9c44661d6b24007b7dc0982a2c998423a118ca776ba4e
-
\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exeFilesize
364KB
MD5891cc4ad6d04f29c301b62f5b12ab56c
SHA13ffdb2f7bf0d7ae0101680d11b2b5fdc3010cbfc
SHA2561a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97
SHA5128e2922a47ec9d8f33a0416b585a545ef66edfc281c8222b988adf5fa60e957c0d5b9f5e0d0fde5790cf9c44661d6b24007b7dc0982a2c998423a118ca776ba4e
-
\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exeFilesize
364KB
MD5891cc4ad6d04f29c301b62f5b12ab56c
SHA13ffdb2f7bf0d7ae0101680d11b2b5fdc3010cbfc
SHA2561a7def5c7457f76e19a7dec2c014234bc01a774016c6ecf9e3848fc584bffe97
SHA5128e2922a47ec9d8f33a0416b585a545ef66edfc281c8222b988adf5fa60e957c0d5b9f5e0d0fde5790cf9c44661d6b24007b7dc0982a2c998423a118ca776ba4e
-
memory/1156-61-0x0000000000000000-mapping.dmp
-
memory/1156-64-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/1156-68-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/1164-54-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/1164-56-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/1164-57-0x0000000075671000-0x0000000075673000-memory.dmpFilesize
8KB
-
memory/1164-58-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB
-
memory/1164-69-0x0000000000410000-0x000000000052D000-memory.dmpFilesize
1.1MB