Analysis
-
max time kernel
116s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 14:54
Static task
static1
Behavioral task
behavioral1
Sample
9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe
-
Size
116KB
-
MD5
e46533b40da1d470aea6b0f2639cc1fb
-
SHA1
1bc2240881008a19fdfd7430fd3afc5481caa04a
-
SHA256
9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a
-
SHA512
739d82090fc840b8437a2a14b8dd94aadd2881a3734c9a74526fb1d8dd1314d994d97bf083edebc783cbe81f0210e27ee8ac526e47fb895b5f6502562e2807ef
-
SSDEEP
3072:u7Ns4ln2Ceja1RD4XP999W9l9o999zB999999899fE6e6VE6B999W9l9o999zB9T:ANdlbIP999W9l9o999zB999999899M6D
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\2026435656 = "C:\\ProgramData\\msroav.exe" msiexec.exe -
Blocklisted process makes network request 31 IoCs
flow pid Process 2 988 msiexec.exe 4 988 msiexec.exe 6 988 msiexec.exe 7 988 msiexec.exe 10 988 msiexec.exe 12 988 msiexec.exe 13 988 msiexec.exe 14 988 msiexec.exe 16 988 msiexec.exe 17 988 msiexec.exe 18 988 msiexec.exe 20 988 msiexec.exe 21 988 msiexec.exe 22 988 msiexec.exe 24 988 msiexec.exe 25 988 msiexec.exe 26 988 msiexec.exe 27 988 msiexec.exe 28 988 msiexec.exe 29 988 msiexec.exe 30 988 msiexec.exe 31 988 msiexec.exe 32 988 msiexec.exe 33 988 msiexec.exe 34 988 msiexec.exe 35 988 msiexec.exe 36 988 msiexec.exe 37 988 msiexec.exe 38 988 msiexec.exe 39 988 msiexec.exe 40 988 msiexec.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 988 msiexec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\software\microsoft\windows\currentversion\Run msiexec.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 816 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 816 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 988 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 1264 wrote to memory of 816 1264 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 28 PID 816 wrote to memory of 988 816 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 29 PID 816 wrote to memory of 988 816 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 29 PID 816 wrote to memory of 988 816 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 29 PID 816 wrote to memory of 988 816 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 29 PID 816 wrote to memory of 988 816 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 29 PID 816 wrote to memory of 988 816 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 29 PID 816 wrote to memory of 988 816 9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe"C:\Users\Admin\AppData\Local\Temp\9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe"C:\Users\Admin\AppData\Local\Temp\9dc62596ec0ef91388425b4f9053eaad3ffa405519969b15ecb426babec7779a.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Deletes itself
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:988
-
-