34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5

General

Target

34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe
Size

17KB
MD5

b2e6b56e34c4bc4d3da91e7005b1b245
SHA1

e949566f92095a5cd1a4b072db977fac973a4604
SHA256

34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5
SHA512

6f9efed1b96f0efb3284f58a985666528b41edd72793bd2377d7f283ae183eef24a6561dbf2b72224f9cd512aafd60b1206166bf4baa4e955a59ac7726c1ab72
SSDEEP

384:1qhiINxgyfTR1IbGgcC32uMu3z8dmNPMXeE8GXB/mnVLavn3:MYitLRMGI2VdmN0XeE8u/icv

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msiexec.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

msiexec.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1541733045 = "C:\\ProgramData\\msnci.exe"	msiexec.exe

Blocklisted process makes network request 7 IoCs

Processes:

msiexec.exe

flow pid process

2 956 msiexec.exe
3 956 msiexec.exe
5 956 msiexec.exe
6 956 msiexec.exe
10 956 msiexec.exe
11 956 msiexec.exe
12 956 msiexec.exe
Disables taskbar notifications via registry modification
evasion
Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

956 msiexec.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msiexec.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\Run msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exemsiexec.exe

pid process

1488 34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe
956 msiexec.exe

flow	pid	process
2	956	msiexec.exe
3	956	msiexec.exe
5	956	msiexec.exe
6	956	msiexec.exe
10	956	msiexec.exe
11	956	msiexec.exe
12	956	msiexec.exe

pid	process
956	msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\Run	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe

pid	process
1488	34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe
1488	34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

msiexec.exe

description pid process

Token: SeDebugPrivilege 956 msiexec.exe

description	pid	process
Token: SeDebugPrivilege	956	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe

description	pid	process	target process
PID 1488 wrote to memory of 956	1488	34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe	msiexec.exe
PID 1488 wrote to memory of 956	1488	34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe	msiexec.exe
PID 1488 wrote to memory of 956	1488	34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe	msiexec.exe
PID 1488 wrote to memory of 956	1488	34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe	msiexec.exe
PID 1488 wrote to memory of 956	1488	34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe	msiexec.exe
PID 1488 wrote to memory of 956	1488	34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe	msiexec.exe
PID 1488 wrote to memory of 956	1488	34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe
"C:\Users\Admin\AppData\Local\Temp\34944fffa0653ac168051be3f8b7133e1bd72f7ecb78330db52bb3b05bd30fb5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Deletes itself
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

4

T1112

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-57-0x0000000000000000-mapping.dmp

Download
memory/956-59-0x0000000000950000-0x0000000000964000-memory.dmp

Filesize
80KB

Download
memory/956-60-0x00000000000D0000-0x00000000000D7000-memory.dmp

Filesize
28KB

Download
memory/956-61-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download
memory/956-62-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download
memory/1488-54-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1488-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1488-56-0x000000007EF90000-0x000000007EF97000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads