d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870

General

Target

d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe
Size

43KB
MD5

0c054d512ebfcdade1a7ba714bfcf15f
SHA1

26a8e96a5869dde53c2a731faa46e4e6d05c02f7
SHA256

d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870
SHA512

43f20ffc30d514182d8ab81859339a8d20b8ca4f40787d9745408e7a595b5152bf73ff984ae9d69ce88cacba7e2b8c2fbf68bc5782986eb4209374e9229cab9e
SSDEEP

768:3kPCnFY+CynO+svwSkhmN8A8Yqrh8tW8hJJdcMyi+y+YksHZC:UPCnOZVvwSkhmm1YqrC7vcMyi+yHHZC

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msiexec.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

msiexec.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\725871703 = "C:\\ProgramData\\msbczmcz.exe"	msiexec.exe

Blocklisted process makes network request 17 IoCs

Processes:

msiexec.exe

flow	pid	process
2	672	msiexec.exe
3	672	msiexec.exe
5	672	msiexec.exe
6	672	msiexec.exe
9	672	msiexec.exe
11	672	msiexec.exe
14	672	msiexec.exe
16	672	msiexec.exe
18	672	msiexec.exe
20	672	msiexec.exe
21	672	msiexec.exe
22	672	msiexec.exe
23	672	msiexec.exe
24	672	msiexec.exe
25	672	msiexec.exe
26	672	msiexec.exe
27	672	msiexec.exe

Disables taskbar notifications via registry modification
evasion
Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

672 msiexec.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msiexec.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\Run msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exemsiexec.exe

pid process

1348 d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe
672 msiexec.exe

pid	process
672	msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\Run	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe

pid	process
1348	d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe
1348	d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

msiexec.exe

description pid process

Token: SeDebugPrivilege 672 msiexec.exe

description	pid	process
Token: SeDebugPrivilege	672	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe

description	pid	process	target process
PID 1348 wrote to memory of 672	1348	d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe	msiexec.exe
PID 1348 wrote to memory of 672	1348	d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe	msiexec.exe
PID 1348 wrote to memory of 672	1348	d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe	msiexec.exe
PID 1348 wrote to memory of 672	1348	d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe	msiexec.exe
PID 1348 wrote to memory of 672	1348	d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe	msiexec.exe
PID 1348 wrote to memory of 672	1348	d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe	msiexec.exe
PID 1348 wrote to memory of 672	1348	d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe
"C:\Users\Admin\AppData\Local\Temp\d3c9fb925cc60b34166711d806f34592b333e3555d30a8957e89d08771768870.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Deletes itself
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-58-0x0000000000000000-mapping.dmp

Download
memory/672-60-0x0000000000730000-0x0000000000744000-memory.dmp

Filesize
80KB

Download
memory/672-61-0x0000000000090000-0x0000000000096000-memory.dmp

Filesize
24KB

Download
memory/672-62-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download
memory/672-63-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download
memory/1348-54-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download
memory/1348-55-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1348-56-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1348-57-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads