Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:41
Static task
static1
Behavioral task
behavioral1
Sample
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe
Resource
win10v2004-20221111-en
General
-
Target
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe
-
Size
82KB
-
MD5
7a9f7f8cfa8a9b003ec8a02c2be2bbf1
-
SHA1
5b14b06002dd19c1d916dc560936860b8d615830
-
SHA256
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179
-
SHA512
a1637d98ef81c89d030dc96e8ca0a7ce5c77a16c9f9e8e4ca5e78166b71ebc2548a8a318af100e2c616466ec679c9271b0eebdaf7eb2862f38f7e0a4869ffde1
-
SSDEEP
1536:tnqdu3abBGy3G8V0iuokdQX2oooD+AyxAr/:tqhMPskdQXMm/
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 2 IoCs
Processes:
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exesca.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt sca.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
Processes:
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exesca.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" sca.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exesca.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sca.exe -
Executes dropped EXE 1 IoCs
Processes:
sca.exepid process 2260 sca.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
sca.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm" sca.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run sca.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
sca.exedescription ioc process File opened (read-only) \??\P: sca.exe File opened (read-only) \??\W: sca.exe File opened (read-only) \??\X: sca.exe File opened (read-only) \??\M: sca.exe File opened (read-only) \??\N: sca.exe File opened (read-only) \??\O: sca.exe File opened (read-only) \??\Q: sca.exe File opened (read-only) \??\U: sca.exe File opened (read-only) \??\Z: sca.exe File opened (read-only) \??\F: sca.exe File opened (read-only) \??\J: sca.exe File opened (read-only) \??\K: sca.exe File opened (read-only) \??\L: sca.exe File opened (read-only) \??\R: sca.exe File opened (read-only) \??\S: sca.exe File opened (read-only) \??\T: sca.exe File opened (read-only) \??\V: sca.exe File opened (read-only) \??\E: sca.exe File opened (read-only) \??\I: sca.exe File opened (read-only) \??\H: sca.exe File opened (read-only) \??\Y: sca.exe File opened (read-only) \??\B: sca.exe File opened (read-only) \??\G: sca.exe -
Drops file in System32 directory 6 IoCs
Processes:
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exesca.exedescription ioc process File created \??\c:\windows\SysWOW64\maxtrox.txt 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe File created \??\c:\windows\SysWOW64\Windows 3D.scr 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe File opened for modification \??\c:\windows\SysWOW64\maxtrox.txt sca.exe File opened for modification \??\c:\windows\SysWOW64\Windows 3D.scr sca.exe File created \??\c:\windows\SysWOW64\Desktop.sysm sca.exe File created \??\c:\windows\SysWOW64\CommandPrompt.Sysm sca.exe -
Drops file in Program Files directory 27 IoCs
Processes:
sca.exedescription ioc process File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe sca.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe sca.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe sca.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe sca.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe sca.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe sca.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpconfig.exe sca.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnetwk.exe sca.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.exe sca.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe sca.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe sca.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.exe sca.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe sca.exe File opened for modification \??\c:\Program Files\Windows Media Player\setup_wm.exe sca.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnscfg.exe sca.exe File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe sca.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe sca.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe sca.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpshare.exe sca.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe sca.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe sca.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe sca.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmplayer.exe sca.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe sca.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe sca.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.exe sca.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.exe sca.exe -
Modifies registry class 36 IoCs
Processes:
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exesca.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" sca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command sca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm sca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" sca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" sca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt sca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt sca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd sca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" sca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" sca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon sca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon sca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command sca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile sca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt sca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" sca.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exesca.exepid process 4744 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe 2260 sca.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exedescription pid process target process PID 4744 wrote to memory of 2260 4744 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe sca.exe PID 4744 wrote to memory of 2260 4744 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe sca.exe PID 4744 wrote to memory of 2260 4744 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe sca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe"C:\Users\Admin\AppData\Local\Temp\847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c195179.exe"1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\sca.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\sca.exe" 847ffc3e90573d4faf845bb9473ce93960527e6d3086a58ef09441503c1951792⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\sca.exeFilesize
82KB
MD5b9812caa00fe49dd92183b81530bc9c5
SHA1df587f23589a2d78fc9c99c2691747a59210d0e4
SHA2569fd40ff9fc05375b068ccb0400770147193d52c2c38064c3a41cb42fe9e2adfa
SHA512fa43434a525c96dd3b9ef920c77133ac9acce8eff2c07b21a746f7506abfd4fd2974172ee399284a1a23eda8294e70045cce0fae1cd112bdb500dd519f641a2d
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\sca.exeFilesize
82KB
MD5b9812caa00fe49dd92183b81530bc9c5
SHA1df587f23589a2d78fc9c99c2691747a59210d0e4
SHA2569fd40ff9fc05375b068ccb0400770147193d52c2c38064c3a41cb42fe9e2adfa
SHA512fa43434a525c96dd3b9ef920c77133ac9acce8eff2c07b21a746f7506abfd4fd2974172ee399284a1a23eda8294e70045cce0fae1cd112bdb500dd519f641a2d
-
\??\c:\windows\SysWOW64\Windows 3D.scrFilesize
82KB
MD557bb9034aa46809d449c9d6010975ed3
SHA1e7e55b0ecae9ce3782a7fa9642df03a5b878f7aa
SHA25639034359d4d5452f6532bec313b705e63c07eb227f68ac990d51ceefa5765efb
SHA51238da8c57ca2ac7e9fc1fa13a45497d78a8e88c10725ec0a14496fdd7e5030aeb0272c7fa67b90def7834922422831228ff6e8d45cf7bd5012253ac6d057a33fb
-
\??\c:\windows\SysWOW64\maxtrox.txtFilesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
memory/2260-134-0x0000000000000000-mapping.dmp