Analysis
-
max time kernel
160s -
max time network
194s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:52
Static task
static1
Behavioral task
behavioral1
Sample
98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe
Resource
win10v2004-20220812-en
General
-
Target
98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe
-
Size
141KB
-
MD5
a0fd4657b35e718014d675ae6800ede5
-
SHA1
4c3bdeebaba38047470665aabce3820e58dee73c
-
SHA256
98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e
-
SHA512
2a7c816739e29aec866ab0858396675df19c9a09a02ce58dcc603585d90ce81349ece905eaa049a4a9469d92da711ddc11bd55e7f1fa891794fd6ab91076a7f8
-
SSDEEP
3072:Lpx9EfghSPsDdnCyJ4ZSP7MJ4hSFeGs66tO8q5czzRs/:39EfghSPgMZSYHs66tA+O
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\2796444834 = "C:\\PROGRA~3\\msrtjsh.exe" msiexec.exe -
Blocklisted process makes network request 18 IoCs
Processes:
msiexec.exeflow pid process 2 580 msiexec.exe 3 580 msiexec.exe 4 580 msiexec.exe 6 580 msiexec.exe 7 580 msiexec.exe 8 580 msiexec.exe 9 580 msiexec.exe 11 580 msiexec.exe 13 580 msiexec.exe 15 580 msiexec.exe 16 580 msiexec.exe 17 580 msiexec.exe 18 580 msiexec.exe 19 580 msiexec.exe 20 580 msiexec.exe 21 580 msiexec.exe 22 580 msiexec.exe 23 580 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exedescription pid process target process PID 1360 set thread context of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\PROGRA~3\msrtjsh.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exemsiexec.exepid process 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 580 msiexec.exe 580 msiexec.exe -
Suspicious behavior: MapViewOfSection 26 IoCs
Processes:
98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exemsiexec.exepid process 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe 580 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
msiexec.exepid process 580 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe Token: SeBackupPrivilege 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe Token: SeRestorePrivilege 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe Token: SeDebugPrivilege 580 msiexec.exe Token: SeBackupPrivilege 580 msiexec.exe Token: SeRestorePrivilege 580 msiexec.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exedescription pid process target process PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1360 wrote to memory of 1344 1360 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe PID 1344 wrote to memory of 580 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe msiexec.exe PID 1344 wrote to memory of 580 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe msiexec.exe PID 1344 wrote to memory of 580 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe msiexec.exe PID 1344 wrote to memory of 580 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe msiexec.exe PID 1344 wrote to memory of 580 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe msiexec.exe PID 1344 wrote to memory of 580 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe msiexec.exe PID 1344 wrote to memory of 580 1344 98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe"C:\Users\Admin\AppData\Local\Temp\98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe"C:\Users\Admin\AppData\Local\Temp\98989e34a8ee70f02678696f0c19d202c54f3a4b2c865ab20846663f988d185e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/580-63-0x0000000000000000-mapping.dmp
-
memory/580-65-0x0000000000380000-0x0000000000394000-memory.dmpFilesize
80KB
-
memory/580-66-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1344-55-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1344-56-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1344-57-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1344-60-0x00000000004016C3-mapping.dmp
-
memory/1344-59-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1344-62-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1360-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB