736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9

Analysis

max time kernel
150s
max time network
109s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe
Size

447KB
MD5

516b74efab1c545aa46110a743e496a6
SHA1

39d8600ccd9eb6efd9626538791d8addc335ea4f
SHA256

736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9
SHA512

d6d267db40a5aaa25b931d337d32a707d4ac391ad6dc241f2394b93819d8c9a52bc0858681ecd4974a99ee9bca714ec6ac0e448e20b6eb8eeb237d377a377d71
SSDEEP

12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTjT+:JoC7ijwFKlVadZ3+8qNC

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msiexec.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

msiexec.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\641036711 = "C:\\PROGRA~3\\msbihi.exe"	msiexec.exe

Blocklisted process makes network request 11 IoCs

Processes:

msiexec.exe

flow	pid	process
2	1924	msiexec.exe
3	1924	msiexec.exe
4	1924	msiexec.exe
5	1924	msiexec.exe
6	1924	msiexec.exe
7	1924	msiexec.exe
8	1924	msiexec.exe
9	1924	msiexec.exe
10	1924	msiexec.exe
11	1924	msiexec.exe
12	1924	msiexec.exe

Disables taskbar notifications via registry modification
evasion
Executes dropped EXE 2 IoCs

Processes:

sf.exeab.exe

pid process

600 sf.exe
368 ab.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exeWScript.exe

pid process

1984 cmd.exe
364 WScript.exe
Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\PROGRA~3\msbihi.exe msiexec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ab.exemsiexec.execmd.exe

pid process

368 ab.exe
1924 msiexec.exe
1924 msiexec.exe
1276 cmd.exe

pid	process
600	sf.exe
368	ab.exe

pid	process
1984	cmd.exe
364	WScript.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\msbihi.exe	msiexec.exe

Suspicious behavior: MapViewOfSection 27 IoCs

Processes:

ab.exemsiexec.exe

pid	process
368	ab.exe
368	ab.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe
1924	msiexec.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

ab.exemsiexec.execmd.exe

description	pid	process
Token: SeDebugPrivilege	368	ab.exe
Token: SeBackupPrivilege	368	ab.exe
Token: SeRestorePrivilege	368	ab.exe
Token: SeDebugPrivilege	1924	msiexec.exe
Token: SeBackupPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeDebugPrivilege	1276	cmd.exe
Token: SeBackupPrivilege	1276	cmd.exe
Token: SeRestorePrivilege	1276	cmd.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1200 AcroRd32.exe
1200 AcroRd32.exe
1200 AcroRd32.exe
1200 AcroRd32.exe

pid	process
1200	AcroRd32.exe
1200	AcroRd32.exe
1200	AcroRd32.exe
1200	AcroRd32.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exeWScript.execmd.execmd.exesf.exeWScript.exeab.exe

description	pid	process	target process
PID 1644 wrote to memory of 948	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	cmd.exe
PID 1644 wrote to memory of 948	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	cmd.exe
PID 1644 wrote to memory of 948	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	cmd.exe
PID 1644 wrote to memory of 948	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	cmd.exe
PID 1644 wrote to memory of 948	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	cmd.exe
PID 1644 wrote to memory of 948	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	cmd.exe
PID 1644 wrote to memory of 948	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	cmd.exe
PID 1644 wrote to memory of 1732	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	WScript.exe
PID 1644 wrote to memory of 1732	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	WScript.exe
PID 1644 wrote to memory of 1732	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	WScript.exe
PID 1644 wrote to memory of 1732	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	WScript.exe
PID 1644 wrote to memory of 1732	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	WScript.exe
PID 1644 wrote to memory of 1732	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	WScript.exe
PID 1644 wrote to memory of 1732	1644	736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe	WScript.exe
PID 1732 wrote to memory of 1984	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1984	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1984	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1984	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1984	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1984	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1984	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1276	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1276	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1276	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1276	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1276	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1276	1732	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1276	1732	WScript.exe	cmd.exe
PID 1984 wrote to memory of 600	1984	cmd.exe	sf.exe
PID 1984 wrote to memory of 600	1984	cmd.exe	sf.exe
PID 1984 wrote to memory of 600	1984	cmd.exe	sf.exe
PID 1984 wrote to memory of 600	1984	cmd.exe	sf.exe
PID 1984 wrote to memory of 600	1984	cmd.exe	sf.exe
PID 1984 wrote to memory of 600	1984	cmd.exe	sf.exe
PID 1984 wrote to memory of 600	1984	cmd.exe	sf.exe
PID 1276 wrote to memory of 1200	1276	cmd.exe	AcroRd32.exe
PID 1276 wrote to memory of 1200	1276	cmd.exe	AcroRd32.exe
PID 1276 wrote to memory of 1200	1276	cmd.exe	AcroRd32.exe
PID 1276 wrote to memory of 1200	1276	cmd.exe	AcroRd32.exe
PID 1276 wrote to memory of 1200	1276	cmd.exe	AcroRd32.exe
PID 1276 wrote to memory of 1200	1276	cmd.exe	AcroRd32.exe
PID 1276 wrote to memory of 1200	1276	cmd.exe	AcroRd32.exe
PID 600 wrote to memory of 364	600	sf.exe	WScript.exe
PID 600 wrote to memory of 364	600	sf.exe	WScript.exe
PID 600 wrote to memory of 364	600	sf.exe	WScript.exe
PID 600 wrote to memory of 364	600	sf.exe	WScript.exe
PID 600 wrote to memory of 364	600	sf.exe	WScript.exe
PID 600 wrote to memory of 364	600	sf.exe	WScript.exe
PID 600 wrote to memory of 364	600	sf.exe	WScript.exe
PID 364 wrote to memory of 368	364	WScript.exe	ab.exe
PID 364 wrote to memory of 368	364	WScript.exe	ab.exe
PID 364 wrote to memory of 368	364	WScript.exe	ab.exe
PID 364 wrote to memory of 368	364	WScript.exe	ab.exe
PID 364 wrote to memory of 368	364	WScript.exe	ab.exe
PID 364 wrote to memory of 368	364	WScript.exe	ab.exe
PID 364 wrote to memory of 368	364	WScript.exe	ab.exe
PID 368 wrote to memory of 1924	368	ab.exe	msiexec.exe
PID 368 wrote to memory of 1924	368	ab.exe	msiexec.exe
PID 368 wrote to memory of 1924	368	ab.exe	msiexec.exe
PID 368 wrote to memory of 1924	368	ab.exe	msiexec.exe
PID 368 wrote to memory of 1924	368	ab.exe	msiexec.exe
PID 368 wrote to memory of 1924	368	ab.exe	msiexec.exe
PID 368 wrote to memory of 1924	368	ab.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe
"C:\Users\Admin\AppData\Local\Temp\736f20990a13756c950e6b13c4b3a3d10a2d6ab79b33293f73ada6370f98c6e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\WINDOWS\SysWOW64\cmd.exe
"C:\WINDOWS\system32\cmd.exe" /c rename C:\Users\Admin\AppData\Local\Temp\outside.gif outside.js
2⤵
PID:948

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\outside.js"
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\sf.exe -pGlue -dC:\Users\Admin\AppData\Local\Temp
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984

C:\Users\Admin\AppData\Local\Temp\sf.exe
C:\Users\Admin\AppData\Local\Temp\sf.exe -pGlue -dC:\Users\Admin\AppData\Local\Temp
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\inside.js"
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364

C:\Users\Admin\AppData\Local\Temp\ab.exe
"C:\Users\Admin\AppData\Local\Temp\ab.exe" -dC:\Users\Admin\AppData\Local\Temp
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\SysWOW64\msiexec.exe
7⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Shipping_Invoice.pdf -dC:\Users\Admin\AppData\Local\Temp
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Shipping_Invoice.pdf"
4⤵
- Suspicious use of SetWindowsHookEx
PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Shipping_Invoice.pdf

Filesize
9KB

MD5
998acb522b47bbfe95f9954d17aa9918

SHA1
e351952afc397d6e127784fe692cf4259e1c6189

SHA256
409e472b667ae747942e10d4dc691796c3b2eb00a0e407146e69b2f8205de40c

SHA512
be047cc246765384f0a484759849d75ac32edbfcd6d5f4a7b96e9a63f2afedd5ff5386db038885455f1736c450b57b9c2e9b9242b740c3560677a35432a3f760

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab.exe

Filesize
139KB

MD5
d7a7d31b679ef0b85847cc6001cd024f

SHA1
2a648ebc0a3acb54aa2a4a109936c3e84fc6cd39

SHA256
39af3f7f7a5f8cd5671fb83e122236070248361b284defa6476d5751f697ff66

SHA512
12d56566114d299ba3f38eebf0ffca1ce7c6ab5d12352dc23f89ae516194379992f098e7b2a5d53fc0c93fab17b512449894f82678c4391b4285cb1896c59741

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab.exe

Filesize
139KB

MD5
d7a7d31b679ef0b85847cc6001cd024f

SHA1
2a648ebc0a3acb54aa2a4a109936c3e84fc6cd39

SHA256
39af3f7f7a5f8cd5671fb83e122236070248361b284defa6476d5751f697ff66

SHA512
12d56566114d299ba3f38eebf0ffca1ce7c6ab5d12352dc23f89ae516194379992f098e7b2a5d53fc0c93fab17b512449894f82678c4391b4285cb1896c59741

Download Submit
C:\Users\Admin\AppData\Local\Temp\inside.js

Filesize
81B

MD5
60eb46dd81c28a274d8f2aef1bc557fa

SHA1
902d992c6b245a70a84632608122e976d561c09d

SHA256
df58a069bd5d2b98275dd124dc72de12ff5fccfb86eeb698c7a63ae9875da026

SHA512
1ded12c5aca377c289d412c6f8ed6903dbaaf5de3413b94cb8b57eef7913d84a3d115426267fa5e48e5277b902f67840a9362283d1cc6e8cb87648c2a8c20633

Download Submit
C:\Users\Admin\AppData\Local\Temp\outside.gif

Filesize
972B

MD5
0ee537f176cfd99964a85186db06d302

SHA1
77aa74fb3a14b56fe35964f4042f8d39dccf1684

SHA256
d7714fab24c3c172b2c3e9a0a6fd155deb4911c041528f4c0289b601f06a559f

SHA512
dbd7a68b30202301f6958f0c4927b010148a1877bbc02961dde8a65154ff9bfce421e375e859f6524b4b834af716e02271b221d58f5036f172c3529c5723c38f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sf.exe

Filesize
277KB

MD5
8716ac6ce445a226080763da7df57f00

SHA1
5e29e26b90b409041770236205f521e8722aa0df

SHA256
12850970a3b394cc59e88e4cb2a5ebf2319d4d5c27312ec7cd9d50188d83cd6c

SHA512
558e13f998da96164fa8fabee5e596dfb89b2492ff64b27d6ea873ff9eb6ac00cd1a33bfee55720351a20d6b26c65613474e2ff1c555faec8bec4447d4c0d354

Download Submit
C:\Users\Admin\AppData\Local\Temp\sf.exe

Filesize
277KB

MD5
8716ac6ce445a226080763da7df57f00

SHA1
5e29e26b90b409041770236205f521e8722aa0df

SHA256
12850970a3b394cc59e88e4cb2a5ebf2319d4d5c27312ec7cd9d50188d83cd6c

SHA512
558e13f998da96164fa8fabee5e596dfb89b2492ff64b27d6ea873ff9eb6ac00cd1a33bfee55720351a20d6b26c65613474e2ff1c555faec8bec4447d4c0d354

Download Submit
C:\Users\Admin\AppData\Local\Temp\sf.png

Filesize
277KB

MD5
c04a4315c0ba40acaee4c345304b9278

SHA1
edbe6baa536fdf0b1946df6d88e4004c8d32eb2b

SHA256
c017fea199a5182078c98d716697a31d90c80f13df8b610ef36fa1feff4051c7

SHA512
23c2b53feeaca042b2f3ac47d9dba820e4c57bad1f4c008087cd5937565a50cabb42ec08414bfb8a31897c4e93f6164dee02840289efbfd2ed4e78bb91b69271

Download Submit
\Users\Admin\AppData\Local\Temp\ab.exe

Filesize
139KB

MD5
d7a7d31b679ef0b85847cc6001cd024f

SHA1
2a648ebc0a3acb54aa2a4a109936c3e84fc6cd39

SHA256
39af3f7f7a5f8cd5671fb83e122236070248361b284defa6476d5751f697ff66

SHA512
12d56566114d299ba3f38eebf0ffca1ce7c6ab5d12352dc23f89ae516194379992f098e7b2a5d53fc0c93fab17b512449894f82678c4391b4285cb1896c59741

Download Submit
\Users\Admin\AppData\Local\Temp\sf.exe

Filesize
277KB

MD5
8716ac6ce445a226080763da7df57f00

SHA1
5e29e26b90b409041770236205f521e8722aa0df

SHA256
12850970a3b394cc59e88e4cb2a5ebf2319d4d5c27312ec7cd9d50188d83cd6c

SHA512
558e13f998da96164fa8fabee5e596dfb89b2492ff64b27d6ea873ff9eb6ac00cd1a33bfee55720351a20d6b26c65613474e2ff1c555faec8bec4447d4c0d354

Download Submit
memory/364-72-0x0000000000000000-mapping.dmp

Download
memory/368-77-0x0000000000000000-mapping.dmp

Download
memory/368-84-0x0000000002010000-0x00000000020A5000-memory.dmp

Filesize
596KB

Download
memory/368-82-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download
memory/368-80-0x0000000002010000-0x00000000020A5000-memory.dmp

Filesize
596KB

Download
memory/600-67-0x0000000000000000-mapping.dmp

Download
memory/948-55-0x0000000000000000-mapping.dmp

Download
memory/1200-70-0x0000000000000000-mapping.dmp

Download
memory/1276-63-0x0000000000000000-mapping.dmp

Download
memory/1276-89-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download
memory/1644-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1732-58-0x0000000000000000-mapping.dmp

Download
memory/1924-81-0x0000000000000000-mapping.dmp

Download
memory/1924-87-0x0000000000090000-0x0000000000095000-memory.dmp

Filesize
20KB

Download
memory/1924-86-0x00000000002E0000-0x00000000002F4000-memory.dmp

Filesize
80KB

Download
memory/1924-88-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download
memory/1924-90-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download
memory/1984-61-0x0000000000000000-mapping.dmp

Download