Analysis
-
max time kernel
243s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:27
Static task
static1
Behavioral task
behavioral1
Sample
91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe
Resource
win10v2004-20220812-en
General
-
Target
91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe
-
Size
152KB
-
MD5
b1de7054abb241346032fd9f7ece5ade
-
SHA1
e90bed8fbbc09b46e7b30daecd389e904bcdbf4c
-
SHA256
91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2
-
SHA512
183a160aef5ce84ea9803950c5cc588fc55445e98257b57d3170cfcfbf272beeeb95f4ee225dc52083ca7af0f0b907fced6c363afb68d1e43affdd25df4c7123
-
SSDEEP
1536:Em5NbGvNizYf/aFWIPNDGe8gy8a9fyEeVmgbmOoirBOGbAShbqkSZZZ3gURD8ibv:H7YfIDZ8gy8WXamkmOx3bVDUNRD5byFA
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1255970050 = "C:\\PROGRA~3\\msoohfyy.exe" msiexec.exe -
Blocklisted process makes network request 18 IoCs
Processes:
msiexec.exeflow pid process 2 748 msiexec.exe 3 748 msiexec.exe 4 748 msiexec.exe 6 748 msiexec.exe 7 748 msiexec.exe 8 748 msiexec.exe 9 748 msiexec.exe 11 748 msiexec.exe 13 748 msiexec.exe 15 748 msiexec.exe 16 748 msiexec.exe 17 748 msiexec.exe 18 748 msiexec.exe 19 748 msiexec.exe 20 748 msiexec.exe 21 748 msiexec.exe 22 748 msiexec.exe 23 748 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exedescription pid process target process PID 1712 set thread context of 1988 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\PROGRA~3\msoohfyy.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exemsiexec.exepid process 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 748 msiexec.exe 748 msiexec.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
Processes:
91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exemsiexec.exepid process 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe 748 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
msiexec.exepid process 748 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe Token: SeBackupPrivilege 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe Token: SeRestorePrivilege 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe Token: SeDebugPrivilege 748 msiexec.exe Token: SeBackupPrivilege 748 msiexec.exe Token: SeRestorePrivilege 748 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exedescription pid process target process PID 1712 wrote to memory of 1988 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe PID 1712 wrote to memory of 1988 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe PID 1712 wrote to memory of 1988 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe PID 1712 wrote to memory of 1988 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe PID 1712 wrote to memory of 1988 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe PID 1712 wrote to memory of 1988 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe PID 1712 wrote to memory of 1988 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe PID 1712 wrote to memory of 1988 1712 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe PID 1988 wrote to memory of 748 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe msiexec.exe PID 1988 wrote to memory of 748 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe msiexec.exe PID 1988 wrote to memory of 748 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe msiexec.exe PID 1988 wrote to memory of 748 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe msiexec.exe PID 1988 wrote to memory of 748 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe msiexec.exe PID 1988 wrote to memory of 748 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe msiexec.exe PID 1988 wrote to memory of 748 1988 91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe"C:\Users\Admin\AppData\Local\Temp\91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe"C:\Users\Admin\AppData\Local\Temp\91e31bf14a0bcdf34521bd5b4720fea821c83abc3f5dd64b683128180d38c3d2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/748-63-0x0000000000000000-mapping.dmp
-
memory/748-66-0x0000000000510000-0x0000000000524000-memory.dmpFilesize
80KB
-
memory/748-67-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1712-60-0x0000000000230000-0x0000000000235000-memory.dmpFilesize
20KB
-
memory/1988-54-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1988-55-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1988-56-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1988-59-0x00000000004016C3-mapping.dmp
-
memory/1988-58-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1988-61-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1988-62-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB
-
memory/1988-65-0x000000007EF90000-0x000000007EF96000-memory.dmpFilesize
24KB