Analysis
-
max time kernel
34s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 16:48
Static task
static1
Behavioral task
behavioral1
Sample
f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe
Resource
win10v2004-20220812-en
General
-
Target
f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe
-
Size
73KB
-
MD5
e36ff18f794ff51c15c08bac37d4c431
-
SHA1
48361224b386e7ec007f2cdb1f7a55a0dba965ad
-
SHA256
f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546
-
SHA512
c1ec260e14b7aaa988c90efaf15b71e88e2fc23781128f08f5a67fd27520d944e9e8aa7c7613fe9c2646d9fd042392ec391de8db869acbd86f1f6d0e63f62291
-
SSDEEP
1536:8W2zMKzBAxiURheeZzXFMShQKUwlMsWS+lskBW1SVyh+BCtQ:KMSBIiURhNzXFMeUXsWS+lskBW9b
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\2918493772 = "C:\\PROGRA~3\\msjvjazd.exe" msiexec.exe -
Blocklisted process makes network request 5 IoCs
Processes:
msiexec.exeflow pid process 1 1472 msiexec.exe 2 1472 msiexec.exe 3 1472 msiexec.exe 4 1472 msiexec.exe 5 1472 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exedescription pid process target process PID 1608 set thread context of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\PROGRA~3\msjvjazd.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exemsiexec.exepid process 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe 1472 msiexec.exe 1472 msiexec.exe -
Suspicious behavior: MapViewOfSection 24 IoCs
Processes:
f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exemsiexec.exepid process 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe 1472 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
msiexec.exepid process 1472 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe Token: SeBackupPrivilege 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe Token: SeRestorePrivilege 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe Token: SeDebugPrivilege 1472 msiexec.exe Token: SeBackupPrivilege 1472 msiexec.exe Token: SeRestorePrivilege 1472 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exef75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exedescription pid process target process PID 1608 wrote to memory of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe PID 1608 wrote to memory of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe PID 1608 wrote to memory of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe PID 1608 wrote to memory of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe PID 1608 wrote to memory of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe PID 1608 wrote to memory of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe PID 1608 wrote to memory of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe PID 1608 wrote to memory of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe PID 1608 wrote to memory of 1996 1608 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe PID 1996 wrote to memory of 1472 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe msiexec.exe PID 1996 wrote to memory of 1472 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe msiexec.exe PID 1996 wrote to memory of 1472 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe msiexec.exe PID 1996 wrote to memory of 1472 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe msiexec.exe PID 1996 wrote to memory of 1472 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe msiexec.exe PID 1996 wrote to memory of 1472 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe msiexec.exe PID 1996 wrote to memory of 1472 1996 f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe"C:\Users\Admin\AppData\Local\Temp\f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe"C:\Users\Admin\AppData\Local\Temp\f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1472