Analysis
-
max time kernel
153s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:12
Static task
static1
Behavioral task
behavioral1
Sample
fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe
Resource
win10v2004-20221111-en
General
-
Target
fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe
-
Size
492KB
-
MD5
1f95672a8a94aef26f0fec7fb350e339
-
SHA1
fe795dc9fd9dfa2b3430d4035e92798390b110ac
-
SHA256
fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391
-
SHA512
c70925a255dcdeb460435a222e71113fbf7398ff2c95a7220e2277f148946ad79d4db9c1981facbe41bc0624c62adf3fca0edd515ac78e2600e1a4acb025331c
-
SSDEEP
6144:vNc0p9tqViYN5CmV9Cd11lhR/+Dle/SwR00/evXW+rJN/JyyefTNCRC67QtVwG:iCWpDxVql+D6SwqfrtNJDaCk67QtV
Malware Config
Signatures
-
Processes:
fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exeF4D55F6500014973000CE10CB4EB2331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1284 F4D55F6500014973000CE10CB4EB2331.exe -
Deletes itself 1 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1284 F4D55F6500014973000CE10CB4EB2331.exe -
Loads dropped DLL 2 IoCs
Processes:
fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exepid process 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe -
Processes:
fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exeF4D55F6500014973000CE10CB4EB2331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000CE10CB4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000CE10CB4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000CE10CB4EB2331.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000CE10CB4EB2331 = "C:\\ProgramData\\F4D55F6500014973000CE10CB4EB2331\\F4D55F6500014973000CE10CB4EB2331.exe" F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exeF4D55F6500014973000CE10CB4EB2331.exepid process 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
F4D55F6500014973000CE10CB4EB2331.exepid process 1284 F4D55F6500014973000CE10CB4EB2331.exe 1284 F4D55F6500014973000CE10CB4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exedescription pid process target process PID 1236 wrote to memory of 1284 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe F4D55F6500014973000CE10CB4EB2331.exe PID 1236 wrote to memory of 1284 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe F4D55F6500014973000CE10CB4EB2331.exe PID 1236 wrote to memory of 1284 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe F4D55F6500014973000CE10CB4EB2331.exe PID 1236 wrote to memory of 1284 1236 fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe F4D55F6500014973000CE10CB4EB2331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe"C:\Users\Admin\AppData\Local\Temp\fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe"C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exeFilesize
492KB
MD51f95672a8a94aef26f0fec7fb350e339
SHA1fe795dc9fd9dfa2b3430d4035e92798390b110ac
SHA256fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391
SHA512c70925a255dcdeb460435a222e71113fbf7398ff2c95a7220e2277f148946ad79d4db9c1981facbe41bc0624c62adf3fca0edd515ac78e2600e1a4acb025331c
-
C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exeFilesize
492KB
MD51f95672a8a94aef26f0fec7fb350e339
SHA1fe795dc9fd9dfa2b3430d4035e92798390b110ac
SHA256fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391
SHA512c70925a255dcdeb460435a222e71113fbf7398ff2c95a7220e2277f148946ad79d4db9c1981facbe41bc0624c62adf3fca0edd515ac78e2600e1a4acb025331c
-
\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exeFilesize
492KB
MD51f95672a8a94aef26f0fec7fb350e339
SHA1fe795dc9fd9dfa2b3430d4035e92798390b110ac
SHA256fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391
SHA512c70925a255dcdeb460435a222e71113fbf7398ff2c95a7220e2277f148946ad79d4db9c1981facbe41bc0624c62adf3fca0edd515ac78e2600e1a4acb025331c
-
\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exeFilesize
492KB
MD51f95672a8a94aef26f0fec7fb350e339
SHA1fe795dc9fd9dfa2b3430d4035e92798390b110ac
SHA256fda004ab64fedecc4edd6d67906131dc16bebf69d8825f419a2b01969382d391
SHA512c70925a255dcdeb460435a222e71113fbf7398ff2c95a7220e2277f148946ad79d4db9c1981facbe41bc0624c62adf3fca0edd515ac78e2600e1a4acb025331c
-
memory/1236-54-0x0000000075011000-0x0000000075013000-memory.dmpFilesize
8KB
-
memory/1236-55-0x0000000000410000-0x00000000004D8000-memory.dmpFilesize
800KB
-
memory/1236-60-0x0000000000410000-0x00000000004D8000-memory.dmpFilesize
800KB
-
memory/1236-64-0x0000000000410000-0x00000000004D8000-memory.dmpFilesize
800KB
-
memory/1284-58-0x0000000000000000-mapping.dmp
-
memory/1284-63-0x0000000000410000-0x00000000004D8000-memory.dmpFilesize
800KB