Analysis
-
max time kernel
106s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 14:57
Static task
static1
Behavioral task
behavioral1
Sample
cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
-
Size
57KB
-
MD5
310da20a626d85819d981eddeb32ed27
-
SHA1
119be6fd440e39db4b6dd2459b9b9a2cde938ec5
-
SHA256
cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729
-
SHA512
9afca8f0bc415b678e717c766457b7adde1d28107fafdbc6f75457845232a34f2bc1b6f764d3abed3893b1290a717b64e9508c34b8472d10a4277a5b779d1ad8
-
SSDEEP
768:Jf5kuRDCss6nA+MiS1RlY8IAtf0ey3+NAKY7ohturWfADGjS5qQDJ7w6:3k2DW+MHQAd0F3+NXcK5+Ei
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\3243901923 = "C:\\PROGRA~3\\msvwaxu.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\3243901923 = "C:\\PROGRA~3\\msvwaxu.exe" msiexec.exe -
Blocklisted process makes network request 36 IoCs
flow pid Process 2 1204 msiexec.exe 3 1664 msiexec.exe 4 1204 msiexec.exe 5 1664 msiexec.exe 6 1204 msiexec.exe 7 1664 msiexec.exe 9 1664 msiexec.exe 11 1664 msiexec.exe 13 1664 msiexec.exe 15 1664 msiexec.exe 17 1664 msiexec.exe 19 1204 msiexec.exe 20 1204 msiexec.exe 21 1204 msiexec.exe 22 1204 msiexec.exe 23 1204 msiexec.exe 24 1664 msiexec.exe 25 1204 msiexec.exe 27 1204 msiexec.exe 28 1204 msiexec.exe 29 1204 msiexec.exe 30 1204 msiexec.exe 31 1204 msiexec.exe 32 1204 msiexec.exe 33 1204 msiexec.exe 34 1204 msiexec.exe 35 1664 msiexec.exe 36 1664 msiexec.exe 37 1664 msiexec.exe 38 1664 msiexec.exe 39 1664 msiexec.exe 40 1664 msiexec.exe 41 1664 msiexec.exe 42 1664 msiexec.exe 43 1664 msiexec.exe 44 1204 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1416 set thread context of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\PROGRA~3\msvwaxu.exe msiexec.exe File opened for modification C:\PROGRA~3\msvwaxu.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 1664 msiexec.exe 1204 msiexec.exe 1664 msiexec.exe 1204 msiexec.exe -
Suspicious behavior: MapViewOfSection 51 IoCs
pid Process 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1204 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1204 msiexec.exe 1664 msiexec.exe 1204 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1204 msiexec.exe 1664 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1664 msiexec.exe 1664 msiexec.exe 1204 msiexec.exe 1664 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe 1204 msiexec.exe -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 1204 msiexec.exe 1664 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe Token: SeBackupPrivilege 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe Token: SeRestorePrivilege 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe Token: SeDebugPrivilege 1664 msiexec.exe Token: SeBackupPrivilege 1664 msiexec.exe Token: SeRestorePrivilege 1664 msiexec.exe Token: SeDebugPrivilege 1204 msiexec.exe Token: SeBackupPrivilege 1204 msiexec.exe Token: SeRestorePrivilege 1204 msiexec.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1416 wrote to memory of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 PID 1416 wrote to memory of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 PID 1416 wrote to memory of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 PID 1416 wrote to memory of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 PID 1416 wrote to memory of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 PID 1416 wrote to memory of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 PID 1416 wrote to memory of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 PID 1416 wrote to memory of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 PID 1416 wrote to memory of 1980 1416 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 28 PID 1980 wrote to memory of 1664 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 29 PID 1980 wrote to memory of 1664 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 29 PID 1980 wrote to memory of 1664 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 29 PID 1980 wrote to memory of 1664 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 29 PID 1980 wrote to memory of 1664 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 29 PID 1980 wrote to memory of 1664 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 29 PID 1980 wrote to memory of 1664 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 29 PID 1980 wrote to memory of 1204 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 30 PID 1980 wrote to memory of 1204 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 30 PID 1980 wrote to memory of 1204 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 30 PID 1980 wrote to memory of 1204 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 30 PID 1980 wrote to memory of 1204 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 30 PID 1980 wrote to memory of 1204 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 30 PID 1980 wrote to memory of 1204 1980 cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe"C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe"C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-