Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 12:40
Static task
static1
Behavioral task
behavioral1
Sample
6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe
Resource
win10v2004-20220901-en
General
-
Target
6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe
-
Size
55KB
-
MD5
d85b27367fe2525cfe48e852620dc23b
-
SHA1
2c5aa228883fe2e19c02577b4acd1ef3927b8da5
-
SHA256
6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab
-
SHA512
8900067072a030d44c416f2e3593bed848425d6c221e7ec022fb0ed12dd1604542ea2a0b666ee3ddeae4b924ca96b356962965dbebbc1ded84740b40f289d9e5
-
SSDEEP
768:FP7HulHnyozBT0HmZ5Gz396lpC2TwTp0Uq3acFzKD3RlY4cIL0b+28z+g:l7O1yo11ZUAlpHEXqqcFeI4cItig
Malware Config
Signatures
-
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\16580 = "c:\\progra~3\\msyfjufn.exe" msiexec.exe -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exeflow pid process 12 4612 msiexec.exe 49 4612 msiexec.exe 62 4612 msiexec.exe -
Disables taskbar notifications via registry modification
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created \??\c:\progra~3\msyfjufn.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exemsiexec.exepid process 4708 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe 4708 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe 4708 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe 4708 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exemsiexec.exepid process 4708 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe 4708 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe 4612 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
msiexec.exedescription pid process Token: SeDebugPrivilege 4612 msiexec.exe Token: SeBackupPrivilege 4612 msiexec.exe Token: SeRestorePrivilege 4612 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exemsiexec.exedescription pid process target process PID 4708 wrote to memory of 4612 4708 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe msiexec.exe PID 4708 wrote to memory of 4612 4708 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe msiexec.exe PID 4708 wrote to memory of 4612 4708 6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe msiexec.exe PID 4612 wrote to memory of 4156 4612 msiexec.exe msiexec.exe PID 4612 wrote to memory of 4156 4612 msiexec.exe msiexec.exe PID 4612 wrote to memory of 4156 4612 msiexec.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe"C:\Users\Admin\AppData\Local\Temp\6e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe2⤵
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵PID:4156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\progra~3\msyfjufn.exeFilesize
55KB
MD5d85b27367fe2525cfe48e852620dc23b
SHA12c5aa228883fe2e19c02577b4acd1ef3927b8da5
SHA2566e1876f992220997545f694fabb9720697e1af01452d2468d34cd08e5133afab
SHA5128900067072a030d44c416f2e3593bed848425d6c221e7ec022fb0ed12dd1604542ea2a0b666ee3ddeae4b924ca96b356962965dbebbc1ded84740b40f289d9e5
-
memory/4156-138-0x0000000000000000-mapping.dmp
-
memory/4612-134-0x0000000000000000-mapping.dmp
-
memory/4612-135-0x0000000000BD0000-0x0000000000BE2000-memory.dmpFilesize
72KB
-
memory/4612-136-0x0000000000A20000-0x0000000000A27000-memory.dmpFilesize
28KB
-
memory/4612-137-0x000000007F980000-0x000000007F987000-memory.dmpFilesize
28KB
-
memory/4612-140-0x000000007F980000-0x000000007F987000-memory.dmpFilesize
28KB
-
memory/4708-132-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4708-133-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB