Analysis
-
max time kernel
149s -
max time network
110s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:13
Static task
static1
Behavioral task
behavioral1
Sample
40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe
Resource
win10v2004-20220812-en
General
-
Target
40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe
-
Size
492KB
-
MD5
5ecd652d795dc01c250a16af4728bdf4
-
SHA1
fce96372d5f79a59a9b3163f51b417f708225140
-
SHA256
40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe
-
SHA512
09e25ca192ac3a114d6741ce3c3f1c55c9325ea18727492e79615945a21b8e0ef8ca9761101603cafcd77d25b5fc2db0b31a252aab696b6e08af64a6dedc9bfb
-
SSDEEP
6144:PNc0p9tqViYN5CmV9Cd11lhR/+Dle/SwR00/evXW+rJN/JyyefTNCRC67QtVwg:CCWpDxVql+D6SwqfrtNJDaCk67QtV
Malware Config
Signatures
-
Processes:
40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exeF4D55F6500014973000C7881B4EB2331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
F4D55F6500014973000C7881B4EB2331.exepid process 1272 F4D55F6500014973000C7881B4EB2331.exe -
Deletes itself 1 IoCs
Processes:
F4D55F6500014973000C7881B4EB2331.exepid process 1272 F4D55F6500014973000C7881B4EB2331.exe -
Loads dropped DLL 2 IoCs
Processes:
40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exepid process 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe -
Processes:
40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exeF4D55F6500014973000C7881B4EB2331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C7881B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C7881B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C7881B4EB2331.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
F4D55F6500014973000C7881B4EB2331.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000C7881B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000C7881B4EB2331\\F4D55F6500014973000C7881B4EB2331.exe" F4D55F6500014973000C7881B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exeF4D55F6500014973000C7881B4EB2331.exepid process 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
F4D55F6500014973000C7881B4EB2331.exepid process 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
F4D55F6500014973000C7881B4EB2331.exepid process 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
F4D55F6500014973000C7881B4EB2331.exepid process 1272 F4D55F6500014973000C7881B4EB2331.exe 1272 F4D55F6500014973000C7881B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exedescription pid process target process PID 1632 wrote to memory of 1272 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe F4D55F6500014973000C7881B4EB2331.exe PID 1632 wrote to memory of 1272 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe F4D55F6500014973000C7881B4EB2331.exe PID 1632 wrote to memory of 1272 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe F4D55F6500014973000C7881B4EB2331.exe PID 1632 wrote to memory of 1272 1632 40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe F4D55F6500014973000C7881B4EB2331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe"C:\Users\Admin\AppData\Local\Temp\40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\F4D55F6500014973000C7881B4EB2331\F4D55F6500014973000C7881B4EB2331.exe"C:\ProgramData\F4D55F6500014973000C7881B4EB2331\F4D55F6500014973000C7881B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\40878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\F4D55F6500014973000C7881B4EB2331\F4D55F6500014973000C7881B4EB2331.exeFilesize
492KB
MD55ecd652d795dc01c250a16af4728bdf4
SHA1fce96372d5f79a59a9b3163f51b417f708225140
SHA25640878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe
SHA51209e25ca192ac3a114d6741ce3c3f1c55c9325ea18727492e79615945a21b8e0ef8ca9761101603cafcd77d25b5fc2db0b31a252aab696b6e08af64a6dedc9bfb
-
C:\ProgramData\F4D55F6500014973000C7881B4EB2331\F4D55F6500014973000C7881B4EB2331.exeFilesize
492KB
MD55ecd652d795dc01c250a16af4728bdf4
SHA1fce96372d5f79a59a9b3163f51b417f708225140
SHA25640878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe
SHA51209e25ca192ac3a114d6741ce3c3f1c55c9325ea18727492e79615945a21b8e0ef8ca9761101603cafcd77d25b5fc2db0b31a252aab696b6e08af64a6dedc9bfb
-
\ProgramData\F4D55F6500014973000C7881B4EB2331\F4D55F6500014973000C7881B4EB2331.exeFilesize
492KB
MD55ecd652d795dc01c250a16af4728bdf4
SHA1fce96372d5f79a59a9b3163f51b417f708225140
SHA25640878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe
SHA51209e25ca192ac3a114d6741ce3c3f1c55c9325ea18727492e79615945a21b8e0ef8ca9761101603cafcd77d25b5fc2db0b31a252aab696b6e08af64a6dedc9bfb
-
\ProgramData\F4D55F6500014973000C7881B4EB2331\F4D55F6500014973000C7881B4EB2331.exeFilesize
492KB
MD55ecd652d795dc01c250a16af4728bdf4
SHA1fce96372d5f79a59a9b3163f51b417f708225140
SHA25640878b144546065514592985935d431728501af9783a406ec55102427ebe8bbe
SHA51209e25ca192ac3a114d6741ce3c3f1c55c9325ea18727492e79615945a21b8e0ef8ca9761101603cafcd77d25b5fc2db0b31a252aab696b6e08af64a6dedc9bfb
-
memory/1272-57-0x0000000000000000-mapping.dmp
-
memory/1272-62-0x0000000000410000-0x00000000004D8000-memory.dmpFilesize
800KB
-
memory/1272-63-0x0000000000410000-0x00000000004D8000-memory.dmpFilesize
800KB
-
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1632-59-0x0000000000410000-0x00000000004D8000-memory.dmpFilesize
800KB
-
memory/1632-64-0x0000000000410000-0x00000000004D8000-memory.dmpFilesize
800KB