Analysis
-
max time kernel
189s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:40
Static task
static1
Behavioral task
behavioral1
Sample
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe
Resource
win10v2004-20221111-en
General
-
Target
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe
-
Size
76KB
-
MD5
0cfa9fbedc5413ec26ecfdb96553a4e1
-
SHA1
9a4755d3ce3bd6df8f6acea6ebf6239463d6b5fc
-
SHA256
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22
-
SHA512
daf09881aed9057e15a9a875993d974cd2910b8979ea9d2bdfa2a125bb50073633b451c25f24031d50b9024debbddac35a2396d6ec3e782836fa12ed419e594d
-
SSDEEP
768:7embNRqsuhlGOBrhgFwumSCbxTGy/BBGg4NKJJKqUThbJ32+ve7i40vN0TlT+Xkq:tnqdu3abBGy3G8V0iuo2X
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 2 IoCs
Processes:
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exenam.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt nam.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
Processes:
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exenam.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" nam.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exenam.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nam.exe -
Executes dropped EXE 1 IoCs
Processes:
nam.exepid process 896 nam.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
nam.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm" nam.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
nam.exedescription ioc process File opened (read-only) \??\V: nam.exe File opened (read-only) \??\E: nam.exe File opened (read-only) \??\J: nam.exe File opened (read-only) \??\Q: nam.exe File opened (read-only) \??\R: nam.exe File opened (read-only) \??\F: nam.exe File opened (read-only) \??\P: nam.exe File opened (read-only) \??\U: nam.exe File opened (read-only) \??\N: nam.exe File opened (read-only) \??\S: nam.exe File opened (read-only) \??\W: nam.exe File opened (read-only) \??\H: nam.exe File opened (read-only) \??\I: nam.exe File opened (read-only) \??\K: nam.exe File opened (read-only) \??\M: nam.exe File opened (read-only) \??\T: nam.exe File opened (read-only) \??\X: nam.exe File opened (read-only) \??\Y: nam.exe File opened (read-only) \??\Z: nam.exe File opened (read-only) \??\B: nam.exe File opened (read-only) \??\G: nam.exe File opened (read-only) \??\L: nam.exe File opened (read-only) \??\O: nam.exe -
Drops file in System32 directory 6 IoCs
Processes:
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exenam.exedescription ioc process File created \??\c:\windows\SysWOW64\maxtrox.txt a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe File created \??\c:\windows\SysWOW64\Windows 3D.scr a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe File opened for modification \??\c:\windows\SysWOW64\maxtrox.txt nam.exe File opened for modification \??\c:\windows\SysWOW64\Windows 3D.scr nam.exe File created \??\c:\windows\SysWOW64\Desktop.sysm nam.exe File created \??\c:\windows\SysWOW64\CommandPrompt.Sysm nam.exe -
Drops file in Program Files directory 27 IoCs
Processes:
nam.exedescription ioc process File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.exe nam.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpconfig.exe nam.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe nam.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe nam.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe nam.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpshare.exe nam.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe nam.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe nam.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe nam.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.exe nam.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe nam.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe nam.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe nam.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe nam.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe nam.exe File opened for modification \??\c:\Program Files\Windows Media Player\setup_wm.exe nam.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnetwk.exe nam.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe nam.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe nam.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe nam.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.exe nam.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe nam.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmplayer.exe nam.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe nam.exe File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe nam.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.exe nam.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnscfg.exe nam.exe -
Modifies registry class 36 IoCs
Processes:
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exenam.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt nam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm nam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon nam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" nam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command nam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon nam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" nam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exenam.exepid process 536 a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe 896 nam.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exedescription pid process target process PID 536 wrote to memory of 896 536 a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe nam.exe PID 536 wrote to memory of 896 536 a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe nam.exe PID 536 wrote to memory of 896 536 a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe nam.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe"C:\Users\Admin\AppData\Local\Temp\a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf22.exe"1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\nam.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\nam.exe" a99e0e2de349279a4522a632cfcefe879c557bf0f439f97a6af91534f97ebf222⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\nam.exeFilesize
76KB
MD5422be0af571d182f1a7cdddc68b6bcc4
SHA10969848ff047cbddb282fcc762f77b04a5264feb
SHA256e56de5c2a4a0ed1e44c48b4db631e01f341773c4276ce6fecb055f9492cb3878
SHA512aa1b44a0b5c4a73f8da66bbec736c0ac1a83e3d35b90c82e3f310e811bf7384b5f382f730246f3d509f7ec4d885535a681d28dcd2a65e6726b2a2264fcaafb60
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\nam.exeFilesize
76KB
MD5422be0af571d182f1a7cdddc68b6bcc4
SHA10969848ff047cbddb282fcc762f77b04a5264feb
SHA256e56de5c2a4a0ed1e44c48b4db631e01f341773c4276ce6fecb055f9492cb3878
SHA512aa1b44a0b5c4a73f8da66bbec736c0ac1a83e3d35b90c82e3f310e811bf7384b5f382f730246f3d509f7ec4d885535a681d28dcd2a65e6726b2a2264fcaafb60
-
\??\c:\windows\SysWOW64\Windows 3D.scrFilesize
76KB
MD52e299c3119a22ef26e4d51577c6ace05
SHA1cb522d2455e023eed7382fb9c92cdf1101b3605a
SHA256b61e2c3f71f6d4917b0e4ad41b2f568a7b77aa501b99091de42e9b72e281a65a
SHA512ecaa5eb8279cd2082eb0b7694df75a82263355c431c029ce8a1ad64c83b318adf09bb8ea30f300f7e8bb819ca46eb10984af1493272126c2f63b228732226ebe
-
\??\c:\windows\SysWOW64\maxtrox.txtFilesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
memory/896-134-0x0000000000000000-mapping.dmp