Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe
Resource
win10v2004-20220901-en
General
-
Target
28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe
-
Size
214KB
-
MD5
125f7ee0e477b2d38324e898c59122d4
-
SHA1
95fff303a269619eab0d42de87ca8996d5dd1f87
-
SHA256
28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2
-
SHA512
eb4cb537019f7b72f357901e6acf67deb491990eecaac92572dcaef4b6b2fe4902009e94fd2ea486a82aa3fc7f701b88c98c0ed907252e817590d82d0c4f987c
-
SSDEEP
3072:lt5y3I0xY1ECtsY41XyGaALHPJ3XXbCDh2FmEhp9xlMxvi6+5hLgl:pgTzCt/4OAB3nbCN2cSQx6d5hA
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\3498136361 = "C:\\PROGRA~3\\msysutm.exe" msiexec.exe -
Blocklisted process makes network request 8 IoCs
Processes:
msiexec.exeflow pid process 2 268 msiexec.exe 3 268 msiexec.exe 4 268 msiexec.exe 5 268 msiexec.exe 6 268 msiexec.exe 7 268 msiexec.exe 8 268 msiexec.exe 9 268 msiexec.exe -
Disables taskbar notifications via registry modification
-
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\PROGRA~3\msysutm.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exemsiexec.exepid process 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe 268 msiexec.exe 268 msiexec.exe -
Suspicious behavior: MapViewOfSection 26 IoCs
Processes:
28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exemsiexec.exepid process 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe 268 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
msiexec.exepid process 268 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exemsiexec.exedescription pid process Token: SeDebugPrivilege 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe Token: SeBackupPrivilege 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe Token: SeRestorePrivilege 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe Token: SeDebugPrivilege 268 msiexec.exe Token: SeBackupPrivilege 268 msiexec.exe Token: SeRestorePrivilege 268 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exedescription pid process target process PID 992 wrote to memory of 268 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe msiexec.exe PID 992 wrote to memory of 268 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe msiexec.exe PID 992 wrote to memory of 268 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe msiexec.exe PID 992 wrote to memory of 268 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe msiexec.exe PID 992 wrote to memory of 268 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe msiexec.exe PID 992 wrote to memory of 268 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe msiexec.exe PID 992 wrote to memory of 268 992 28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe"C:\Users\Admin\AppData\Local\Temp\28680a384a4b10dc4bb357ef1ec988f989f15685eeee257262a047cff1285fd2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:268
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-57-0x0000000000000000-mapping.dmp
-
memory/268-60-0x0000000000590000-0x00000000005A4000-memory.dmpFilesize
80KB
-
memory/268-61-0x00000000000D0000-0x00000000000D5000-memory.dmpFilesize
20KB
-
memory/268-62-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/992-54-0x00000000767D1000-0x00000000767D3000-memory.dmpFilesize
8KB
-
memory/992-55-0x0000000001FC0000-0x0000000002055000-memory.dmpFilesize
596KB
-
memory/992-56-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/992-59-0x0000000001FC0000-0x0000000002055000-memory.dmpFilesize
596KB