Analysis
-
max time kernel
167s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:56
Static task
static1
Behavioral task
behavioral1
Sample
4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe
Resource
win10v2004-20220812-en
General
-
Target
4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe
-
Size
384KB
-
MD5
a3ac7ff363b43b671a8818d918268e55
-
SHA1
59de6d8942e224cd96f609740c211a50b82df7bb
-
SHA256
4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47
-
SHA512
e7a0c13c6b286bb30ad6094205f4388aa09891f3fa6b6b3250468a843a76ab8418788b46920d5aa026cfa6b21caa470415f7b1d1667d6d87a3dba93d72d046d1
-
SSDEEP
6144:6EH1C+Rixp8IlKlLwAqGKbb4E6hsQGqnT831vb7nWRuMcgHqS8OEiRm:6EgJD8IbSTIvbDWRuMPKiBo
Malware Config
Signatures
-
Processes:
F4D55F6500014973000B4090B4EB2331.exe4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
F4D55F6500014973000B4090B4EB2331.exepid process 2036 F4D55F6500014973000B4090B4EB2331.exe -
Deletes itself 1 IoCs
Processes:
F4D55F6500014973000B4090B4EB2331.exepid process 2036 F4D55F6500014973000B4090B4EB2331.exe -
Loads dropped DLL 2 IoCs
Processes:
4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exepid process 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe -
Processes:
4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exeF4D55F6500014973000B4090B4EB2331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
F4D55F6500014973000B4090B4EB2331.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce F4D55F6500014973000B4090B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000B4090B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000B4090B4EB2331\\F4D55F6500014973000B4090B4EB2331.exe" F4D55F6500014973000B4090B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exeF4D55F6500014973000B4090B4EB2331.exepid process 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
F4D55F6500014973000B4090B4EB2331.exepid process 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
F4D55F6500014973000B4090B4EB2331.exepid process 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exeF4D55F6500014973000B4090B4EB2331.exepid process 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe 2036 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exedescription pid process target process PID 1112 wrote to memory of 2036 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe F4D55F6500014973000B4090B4EB2331.exe PID 1112 wrote to memory of 2036 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe F4D55F6500014973000B4090B4EB2331.exe PID 1112 wrote to memory of 2036 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe F4D55F6500014973000B4090B4EB2331.exe PID 1112 wrote to memory of 2036 1112 4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe F4D55F6500014973000B4090B4EB2331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe"C:\Users\Admin\AppData\Local\Temp\4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe"C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\4d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2036
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5a3ac7ff363b43b671a8818d918268e55
SHA159de6d8942e224cd96f609740c211a50b82df7bb
SHA2564d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47
SHA512e7a0c13c6b286bb30ad6094205f4388aa09891f3fa6b6b3250468a843a76ab8418788b46920d5aa026cfa6b21caa470415f7b1d1667d6d87a3dba93d72d046d1
-
Filesize
384KB
MD5a3ac7ff363b43b671a8818d918268e55
SHA159de6d8942e224cd96f609740c211a50b82df7bb
SHA2564d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47
SHA512e7a0c13c6b286bb30ad6094205f4388aa09891f3fa6b6b3250468a843a76ab8418788b46920d5aa026cfa6b21caa470415f7b1d1667d6d87a3dba93d72d046d1
-
Filesize
384KB
MD5a3ac7ff363b43b671a8818d918268e55
SHA159de6d8942e224cd96f609740c211a50b82df7bb
SHA2564d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47
SHA512e7a0c13c6b286bb30ad6094205f4388aa09891f3fa6b6b3250468a843a76ab8418788b46920d5aa026cfa6b21caa470415f7b1d1667d6d87a3dba93d72d046d1
-
Filesize
384KB
MD5a3ac7ff363b43b671a8818d918268e55
SHA159de6d8942e224cd96f609740c211a50b82df7bb
SHA2564d948775bba162bb75de684a4b278af4e80f8238e5d00571d0c67741a48a4b47
SHA512e7a0c13c6b286bb30ad6094205f4388aa09891f3fa6b6b3250468a843a76ab8418788b46920d5aa026cfa6b21caa470415f7b1d1667d6d87a3dba93d72d046d1