Analysis
-
max time kernel
99s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:38
Static task
static1
Behavioral task
behavioral1
Sample
945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
Resource
win10v2004-20221111-en
General
-
Target
945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
-
Size
183KB
-
MD5
abe5c0a299ffffb1a7b29bd3ea6fc86c
-
SHA1
11c08a46161c9c1e13c5b10dda277309f1547429
-
SHA256
945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd
-
SHA512
04d5c5cf69b64adcdac89fea0f3559939cdf2630780061b60bab89a930924e9e8f0b8f17c7ca2e0a544cfc8f935e6e021262ff6bdf7a9e9525694223f57deaaa
-
SSDEEP
3072:YLpxTJJWCXx7vCgiFuCiSxS+0qHEC1yhlb4+nFHz6PTGDG:Yt9RdvCgVL4+19q
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1805357526 = "C:\\PROGRA~3\\msdcrbvx.exe" msiexec.exe -
Blocklisted process makes network request 18 IoCs
Processes:
msiexec.exeflow pid process 2 1376 msiexec.exe 3 1376 msiexec.exe 4 1376 msiexec.exe 6 1376 msiexec.exe 7 1376 msiexec.exe 8 1376 msiexec.exe 9 1376 msiexec.exe 11 1376 msiexec.exe 13 1376 msiexec.exe 15 1376 msiexec.exe 16 1376 msiexec.exe 17 1376 msiexec.exe 18 1376 msiexec.exe 19 1376 msiexec.exe 20 1376 msiexec.exe 21 1376 msiexec.exe 22 1376 msiexec.exe 23 1376 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exedescription pid process target process PID 908 set thread context of 1628 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\PROGRA~3\msdcrbvx.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exemsiexec.exepid process 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 1376 msiexec.exe 1376 msiexec.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
Processes:
945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exemsiexec.exepid process 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe 1376 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
msiexec.exepid process 1376 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe Token: SeBackupPrivilege 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe Token: SeRestorePrivilege 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe Token: SeDebugPrivilege 1376 msiexec.exe Token: SeBackupPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exedescription pid process target process PID 908 wrote to memory of 1628 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe PID 908 wrote to memory of 1628 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe PID 908 wrote to memory of 1628 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe PID 908 wrote to memory of 1628 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe PID 908 wrote to memory of 1628 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe PID 908 wrote to memory of 1628 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe PID 908 wrote to memory of 1628 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe PID 908 wrote to memory of 1628 908 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe PID 1628 wrote to memory of 1376 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe msiexec.exe PID 1628 wrote to memory of 1376 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe msiexec.exe PID 1628 wrote to memory of 1376 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe msiexec.exe PID 1628 wrote to memory of 1376 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe msiexec.exe PID 1628 wrote to memory of 1376 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe msiexec.exe PID 1628 wrote to memory of 1376 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe msiexec.exe PID 1628 wrote to memory of 1376 1628 945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe"C:\Users\Admin\AppData\Local\Temp\945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe"C:\Users\Admin\AppData\Local\Temp\945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1376-61-0x0000000000000000-mapping.dmp
-
memory/1376-64-0x0000000000DC0000-0x0000000000DD4000-memory.dmpFilesize
80KB
-
memory/1376-65-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1376-66-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1628-54-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1628-55-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1628-56-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1628-59-0x00000000004016C3-mapping.dmp
-
memory/1628-58-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1628-60-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1628-63-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB