Analysis
-
max time kernel
131s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
Resource
win10v2004-20220812-en
General
-
Target
d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
-
Size
102KB
-
MD5
dbcf6d36bd7eedbb2cd7720b39960c7f
-
SHA1
56f29db2016122359d1d8a71bcbb06573f0350c1
-
SHA256
d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c
-
SHA512
963a7711cd4aa2d60486e7fb0d9f05e193073655c9426336f813c905c0cf6cd917ee72c20c6560ae9a0d093a99fbfb8e1b939c09d2bb0ba86cb64d75e7ee7117
-
SSDEEP
1536:8KIB3GOEsRZYlFww57h30CktP9vyO/S6HTVyAobKhOCtyvR8LnGWCH7aEKvQ:8rB3GDsRZOZQ9vd/3HRy0Ov8LnIaRvQ
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\2249109432 = "C:\\PROGRA~3\\msuzf.exe" msiexec.exe -
Blocklisted process makes network request 18 IoCs
Processes:
msiexec.exeflow pid process 2 1264 msiexec.exe 3 1264 msiexec.exe 4 1264 msiexec.exe 6 1264 msiexec.exe 7 1264 msiexec.exe 8 1264 msiexec.exe 9 1264 msiexec.exe 11 1264 msiexec.exe 13 1264 msiexec.exe 15 1264 msiexec.exe 16 1264 msiexec.exe 17 1264 msiexec.exe 18 1264 msiexec.exe 19 1264 msiexec.exe 20 1264 msiexec.exe 21 1264 msiexec.exe 22 1264 msiexec.exe 23 1264 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exedescription pid process target process PID 1652 set thread context of 1204 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\PROGRA~3\msuzf.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exed7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exemsiexec.exepid process 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe 1264 msiexec.exe 1264 msiexec.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
Processes:
d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exemsiexec.exepid process 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe 1264 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
msiexec.exepid process 1264 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe Token: SeBackupPrivilege 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe Token: SeRestorePrivilege 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe Token: SeDebugPrivilege 1264 msiexec.exe Token: SeBackupPrivilege 1264 msiexec.exe Token: SeRestorePrivilege 1264 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exed7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exedescription pid process target process PID 1652 wrote to memory of 1204 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe PID 1652 wrote to memory of 1204 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe PID 1652 wrote to memory of 1204 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe PID 1652 wrote to memory of 1204 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe PID 1652 wrote to memory of 1204 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe PID 1652 wrote to memory of 1204 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe PID 1652 wrote to memory of 1204 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe PID 1652 wrote to memory of 1204 1652 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe PID 1204 wrote to memory of 1264 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe msiexec.exe PID 1204 wrote to memory of 1264 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe msiexec.exe PID 1204 wrote to memory of 1264 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe msiexec.exe PID 1204 wrote to memory of 1264 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe msiexec.exe PID 1204 wrote to memory of 1264 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe msiexec.exe PID 1204 wrote to memory of 1264 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe msiexec.exe PID 1204 wrote to memory of 1264 1204 d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe"C:\Users\Admin\AppData\Local\Temp\d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe"C:\Users\Admin\AppData\Local\Temp\d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1204-55-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1204-56-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1204-57-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1204-60-0x00000000004016C3-mapping.dmp
-
memory/1204-59-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1204-63-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1264-64-0x0000000000000000-mapping.dmp
-
memory/1264-66-0x0000000000960000-0x0000000000974000-memory.dmpFilesize
80KB
-
memory/1264-67-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1652-54-0x0000000075661000-0x0000000075663000-memory.dmpFilesize
8KB
-
memory/1652-61-0x0000000000220000-0x0000000000225000-memory.dmpFilesize
20KB