39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3

General

Target

39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
Size

61KB
MD5

0c4062ff7f5a7bc41246cc1ade4ce84a
SHA1

09ac772b7a5c33c72289ee792fcb9b3494bf0258
SHA256

39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3
SHA512

2a3b9c6ac502505e7192972b9632f4f443a72169bc969753c336d70c257b3a1376067ba29ced97be038cbbfe84c273a9379342c5d989ad8ec94fdf8f8c47603d
SSDEEP

1536:h4UHxpN/MUXsLTvCj0DBXJaOADnsqgW5qbPnFkbbbWyLZe:h4URpNUUX6z/DBXJfADsqgW5qbWbCuZe

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msiexec.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\633339513 = "C:\\PROGRA~3\\mscqwvxf.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msiexec.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	912	msiexec.exe
3	912	msiexec.exe
4	912	msiexec.exe
5	912	msiexec.exe
6	912	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Loads dropped DLL 1 IoCs

pid	Process
1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~3\mscqwvxf.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
912	msiexec.exe
912	msiexec.exe

Suspicious behavior: MapViewOfSection 25 IoCs

pid	Process
432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe
912	msiexec.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
912	msiexec.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
Token: SeBackupPrivilege	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
Token: SeRestorePrivilege	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
Token: SeDebugPrivilege	912	msiexec.exe
Token: SeBackupPrivilege	912	msiexec.exe
Token: SeRestorePrivilege	912	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 1500 wrote to memory of 432	1500	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	28
PID 432 wrote to memory of 912	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	29
PID 432 wrote to memory of 912	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	29
PID 432 wrote to memory of 912	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	29
PID 432 wrote to memory of 912	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	29
PID 432 wrote to memory of 912	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	29
PID 432 wrote to memory of 912	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	29
PID 432 wrote to memory of 912	432	39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe	29

C:\Users\Admin\AppData\Local\Temp\39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
"C:\Users\Admin\AppData\Local\Temp\39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe
  "C:\Users\Admin\AppData\Local\Temp\39451ea2b2c6fcd09c1661688125bdd4fe59dbc0844167ac1cc4116a683ccbe3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\msiexec.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Adds policy Run key to start application
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious behavior: RenamesItself
    - Suspicious use of AdjustPrivilegeToken
    PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsf3842.tmp\emarginations.dll

Filesize
13KB

MD5
9dfea6dd26dd7928deef806d5b314ec9

SHA1
a5abea6ea350a454873ddb8cda88e4b3023253ff

SHA256
cbe896a3873fa9172ad87d4dd47f2178291e83a8f9329f268bf870d585be0df8

SHA512
c004d2357841745f487deb5c2df9223db70cdfced48dcd11effd06c9b923919ff2b6e3438914858fa0f434525d9694545920d8bd65726901dd1c098310718726

Download Submit
memory/432-56-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/432-57-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/432-58-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/432-60-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/432-63-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download
memory/912-66-0x00000000007F0000-0x0000000000804000-memory.dmp

Filesize
80KB

Download
memory/912-67-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download
memory/912-68-0x000000007EF90000-0x000000007EF96000-memory.dmp

Filesize
24KB

Download
memory/1500-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads