Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:39
Static task
static1
Behavioral task
behavioral1
Sample
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe
Resource
win10v2004-20221111-en
General
-
Target
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe
-
Size
499KB
-
MD5
e123e046e3abd48a95b552b41b75a44d
-
SHA1
8c4952de25385fa3e38032c711d4a2505de3aee3
-
SHA256
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655
-
SHA512
76722ecb00c54776813de019bf52be7c8d08ae13b6f56a08b7b54660af79408a7c092aa848707b56e25baaf858e1b0e89ae6c30dd8d4db931d04b4973b765ca6
-
SSDEEP
6144:UzXhvkZ8gulzV2V9/H5DTwaHd6dcNiXPnpUTJPyd+MElqwkp7:yxMZu2z96dcYXPnpcJPydjZ
Malware Config
Signatures
-
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe -
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe -
Disables taskbar notifications via registry modification
-
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\228E8694CAB98D930022228E64941B26 = "C:\\ProgramData\\228E8694CAB98D930022228E64941B26\\228E8694CAB98D930022228E64941B26.exe" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe -
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exepid process 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exepid process 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exepid process 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exepid process 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe 112 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe"C:\Users\Admin\AppData\Local\Temp\91d60964d55d89eb5cb13801b5c11c203f655fefa6871d5f4e1ebd35d4d65655.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:112