Analysis
-
max time kernel
147s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:07
Static task
static1
Behavioral task
behavioral1
Sample
a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
Resource
win10v2004-20221111-en
General
-
Target
a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
-
Size
122KB
-
MD5
606305f232f9861627be9552fde5bf13
-
SHA1
18d41f9dde4dcaf5d7c73683a0c604940d8ec086
-
SHA256
a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e
-
SHA512
f11500755f6941b5c7a710f7e63665b2fddd618da9b46df98bc25932a047c669d8832ac9070683bc3daa34dd0bb21ef8d0c328da343ced208713cbc6ef11c5fd
-
SSDEEP
3072:aERSHvAEiCSWgYGeTVaMqFr91a+tchcSbpAYp08c:aERGAbb7YGvr9ZMAYuP
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1810686570 = "C:\\PROGRA~3\\mslqxc.exe" msiexec.exe -
Blocklisted process makes network request 20 IoCs
Processes:
msiexec.exeflow pid process 1 976 msiexec.exe 2 976 msiexec.exe 3 976 msiexec.exe 5 976 msiexec.exe 6 976 msiexec.exe 7 976 msiexec.exe 8 976 msiexec.exe 10 976 msiexec.exe 12 976 msiexec.exe 15 976 msiexec.exe 16 976 msiexec.exe 17 976 msiexec.exe 18 976 msiexec.exe 19 976 msiexec.exe 20 976 msiexec.exe 21 976 msiexec.exe 22 976 msiexec.exe 23 976 msiexec.exe 24 976 msiexec.exe 25 976 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exedescription pid process target process PID 1628 set thread context of 1776 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\PROGRA~3\mslqxc.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exea7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exemsiexec.exepid process 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe 976 msiexec.exe 976 msiexec.exe -
Suspicious behavior: MapViewOfSection 26 IoCs
Processes:
a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exemsiexec.exepid process 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe 976 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
msiexec.exepid process 976 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe Token: SeBackupPrivilege 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe Token: SeRestorePrivilege 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe Token: SeDebugPrivilege 976 msiexec.exe Token: SeBackupPrivilege 976 msiexec.exe Token: SeRestorePrivilege 976 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exea7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exedescription pid process target process PID 1628 wrote to memory of 1776 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe PID 1628 wrote to memory of 1776 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe PID 1628 wrote to memory of 1776 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe PID 1628 wrote to memory of 1776 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe PID 1628 wrote to memory of 1776 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe PID 1628 wrote to memory of 1776 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe PID 1628 wrote to memory of 1776 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe PID 1628 wrote to memory of 1776 1628 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe PID 1776 wrote to memory of 976 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe msiexec.exe PID 1776 wrote to memory of 976 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe msiexec.exe PID 1776 wrote to memory of 976 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe msiexec.exe PID 1776 wrote to memory of 976 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe msiexec.exe PID 1776 wrote to memory of 976 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe msiexec.exe PID 1776 wrote to memory of 976 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe msiexec.exe PID 1776 wrote to memory of 976 1776 a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe"C:\Users\Admin\AppData\Local\Temp\a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe"C:\Users\Admin\AppData\Local\Temp\a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:976
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-63-0x0000000000000000-mapping.dmp
-
memory/976-66-0x00000000007B0000-0x00000000007C4000-memory.dmpFilesize
80KB
-
memory/976-67-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/976-68-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1628-54-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1628-62-0x0000000000230000-0x0000000000235000-memory.dmpFilesize
20KB
-
memory/1776-55-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1776-56-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1776-57-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1776-59-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1776-60-0x00000000004016C3-mapping.dmp
-
memory/1776-65-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB