Analysis
-
max time kernel
162s -
max time network
207s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:26
Static task
static1
Behavioral task
behavioral1
Sample
948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe
Resource
win10v2004-20221111-en
General
-
Target
948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe
-
Size
184KB
-
MD5
cc39bcdedfbe824283a90cd720459c8b
-
SHA1
aa50ff08d9d08f605238d4fecc6a8d9227dc2d7e
-
SHA256
948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2
-
SHA512
f02b4eaec8a631c1e66156b80104eed73d677e64672cfac956fa24949de9988c912c226f7e72eba8f6318b2a6505517858e53871b92e068225b9e923d2886ab3
-
SSDEEP
3072:uRJ25t3fom6L+Jv8Rai1HNyUlMoSTxFI8+:sc2LL+JQVyRTu
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1298609420 = "C:\\PROGRA~3\\msbftdbi.exe" msiexec.exe -
Blocklisted process makes network request 18 IoCs
Processes:
msiexec.exeflow pid process 2 788 msiexec.exe 3 788 msiexec.exe 4 788 msiexec.exe 6 788 msiexec.exe 7 788 msiexec.exe 8 788 msiexec.exe 9 788 msiexec.exe 11 788 msiexec.exe 13 788 msiexec.exe 15 788 msiexec.exe 16 788 msiexec.exe 17 788 msiexec.exe 18 788 msiexec.exe 19 788 msiexec.exe 20 788 msiexec.exe 21 788 msiexec.exe 22 788 msiexec.exe 23 788 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exedescription pid process target process PID 1312 set thread context of 932 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\PROGRA~3\msbftdbi.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exemsiexec.exepid process 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 788 msiexec.exe 788 msiexec.exe -
Suspicious behavior: MapViewOfSection 26 IoCs
Processes:
948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exemsiexec.exepid process 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe 788 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
msiexec.exepid process 788 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exemsiexec.exedescription pid process Token: SeDebugPrivilege 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe Token: SeBackupPrivilege 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe Token: SeRestorePrivilege 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe Token: SeDebugPrivilege 788 msiexec.exe Token: SeBackupPrivilege 788 msiexec.exe Token: SeRestorePrivilege 788 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exedescription pid process target process PID 1312 wrote to memory of 932 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe PID 1312 wrote to memory of 932 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe PID 1312 wrote to memory of 932 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe PID 1312 wrote to memory of 932 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe PID 1312 wrote to memory of 932 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe PID 1312 wrote to memory of 932 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe PID 1312 wrote to memory of 932 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe PID 1312 wrote to memory of 932 1312 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe PID 932 wrote to memory of 788 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe msiexec.exe PID 932 wrote to memory of 788 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe msiexec.exe PID 932 wrote to memory of 788 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe msiexec.exe PID 932 wrote to memory of 788 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe msiexec.exe PID 932 wrote to memory of 788 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe msiexec.exe PID 932 wrote to memory of 788 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe msiexec.exe PID 932 wrote to memory of 788 932 948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe"C:\Users\Admin\AppData\Local\Temp\948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe"C:\Users\Admin\AppData\Local\Temp\948896203c45e5ee6d5d57610526d25dfddd4ed0aff595cff3f1bf4d3d7489b2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/788-63-0x0000000000000000-mapping.dmp
-
memory/788-66-0x0000000000E80000-0x0000000000E94000-memory.dmpFilesize
80KB
-
memory/788-67-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/932-56-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/932-57-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/932-58-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/932-60-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/932-61-0x00000000004016C3-mapping.dmp
-
memory/932-65-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1312-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1312-55-0x0000000000260000-0x0000000000265000-memory.dmpFilesize
20KB