Analysis
-
max time kernel
149s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 17:17
Static task
static1
Behavioral task
behavioral1
Sample
ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe
Resource
win10v2004-20220901-en
General
-
Target
ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe
-
Size
396KB
-
MD5
e53d2988aea402da7872768945aa6704
-
SHA1
c228131edf7150ff8ec321293356ba4094c29973
-
SHA256
ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74
-
SHA512
fbbbd22cb1d30f975271ff4bb70206e75f5cb027a78f8d7276dee09961736eed85f853ba84a78ee0325aa3aa0b2d09014f4767600ac7cc78a9ce4763e3d81147
-
SSDEEP
6144:HLRaMiOryutVTqXvZ5WdwhDXQQ8dS9SnVt2uSoasHjfo0:rRRiiyxXvHa40NfnyFzu
Malware Config
Signatures
-
Processes:
ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exeF4D55F6500014973000C06C9B4EB2331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C06C9B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C06C9B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C06C9B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C06C9B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C06C9B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
F4D55F6500014973000C06C9B4EB2331.exepid process 1392 F4D55F6500014973000C06C9B4EB2331.exe -
Deletes itself 1 IoCs
Processes:
F4D55F6500014973000C06C9B4EB2331.exepid process 1392 F4D55F6500014973000C06C9B4EB2331.exe -
Loads dropped DLL 2 IoCs
Processes:
ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exepid process 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe -
Processes:
F4D55F6500014973000C06C9B4EB2331.exeee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C06C9B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C06C9B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C06C9B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C06C9B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C06C9B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C06C9B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C06C9B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
F4D55F6500014973000C06C9B4EB2331.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce F4D55F6500014973000C06C9B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000C06C9B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000C06C9B4EB2331\\F4D55F6500014973000C06C9B4EB2331.exe" F4D55F6500014973000C06C9B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exeF4D55F6500014973000C06C9B4EB2331.exepid process 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
F4D55F6500014973000C06C9B4EB2331.exepid process 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
F4D55F6500014973000C06C9B4EB2331.exepid process 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
F4D55F6500014973000C06C9B4EB2331.exepid process 1392 F4D55F6500014973000C06C9B4EB2331.exe 1392 F4D55F6500014973000C06C9B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exedescription pid process target process PID 1148 wrote to memory of 1392 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe F4D55F6500014973000C06C9B4EB2331.exe PID 1148 wrote to memory of 1392 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe F4D55F6500014973000C06C9B4EB2331.exe PID 1148 wrote to memory of 1392 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe F4D55F6500014973000C06C9B4EB2331.exe PID 1148 wrote to memory of 1392 1148 ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe F4D55F6500014973000C06C9B4EB2331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe"C:\Users\Admin\AppData\Local\Temp\ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exe"C:\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exeFilesize
396KB
MD5e53d2988aea402da7872768945aa6704
SHA1c228131edf7150ff8ec321293356ba4094c29973
SHA256ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74
SHA512fbbbd22cb1d30f975271ff4bb70206e75f5cb027a78f8d7276dee09961736eed85f853ba84a78ee0325aa3aa0b2d09014f4767600ac7cc78a9ce4763e3d81147
-
C:\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exeFilesize
396KB
MD5e53d2988aea402da7872768945aa6704
SHA1c228131edf7150ff8ec321293356ba4094c29973
SHA256ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74
SHA512fbbbd22cb1d30f975271ff4bb70206e75f5cb027a78f8d7276dee09961736eed85f853ba84a78ee0325aa3aa0b2d09014f4767600ac7cc78a9ce4763e3d81147
-
\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exeFilesize
396KB
MD5e53d2988aea402da7872768945aa6704
SHA1c228131edf7150ff8ec321293356ba4094c29973
SHA256ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74
SHA512fbbbd22cb1d30f975271ff4bb70206e75f5cb027a78f8d7276dee09961736eed85f853ba84a78ee0325aa3aa0b2d09014f4767600ac7cc78a9ce4763e3d81147
-
\ProgramData\F4D55F6500014973000C06C9B4EB2331\F4D55F6500014973000C06C9B4EB2331.exeFilesize
396KB
MD5e53d2988aea402da7872768945aa6704
SHA1c228131edf7150ff8ec321293356ba4094c29973
SHA256ee07bffb630712f9366788d3726e610ab1bdf44e49120157441d8e7e2f2e3b74
SHA512fbbbd22cb1d30f975271ff4bb70206e75f5cb027a78f8d7276dee09961736eed85f853ba84a78ee0325aa3aa0b2d09014f4767600ac7cc78a9ce4763e3d81147
-
memory/1148-54-0x0000000074C11000-0x0000000074C13000-memory.dmpFilesize
8KB
-
memory/1148-61-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/1148-64-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/1392-57-0x0000000000000000-mapping.dmp
-
memory/1392-62-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/1392-63-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB