Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
notification.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
notification.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
notification.exe
-
Size
124KB
-
MD5
bba602f3628f39f7d62edaa80cfddfe5
-
SHA1
c71bbfb24984c162e59e2ffbb8be69a5153af28b
-
SHA256
c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca
-
SHA512
c6697b21b69b74da7d2e5cb1900eb95b4d4ed1d63172c956771821d960c7f3487039bd13fc6e049945c9d9db4cfb85e81a5d112758538e6e1ec0e40e33976200
-
SSDEEP
1536:iQOwPGF+Nn76jBwEMxqElwfGwCwFEMxqER6jBaNnU6j5zpIqq21XrH2b7Zm:B1PGsN72GwZrNb5x1b+A
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\3784538504 = "C:\\PROGRA~3\\msclop.exe" msiexec.exe -
Blocklisted process makes network request 27 IoCs
flow pid Process 1 1732 msiexec.exe 2 1732 msiexec.exe 3 1732 msiexec.exe 5 1732 msiexec.exe 7 1732 msiexec.exe 9 1732 msiexec.exe 11 1732 msiexec.exe 13 1732 msiexec.exe 15 1732 msiexec.exe 18 1732 msiexec.exe 19 1732 msiexec.exe 20 1732 msiexec.exe 21 1732 msiexec.exe 22 1732 msiexec.exe 23 1732 msiexec.exe 24 1732 msiexec.exe 25 1732 msiexec.exe 26 1732 msiexec.exe 27 1732 msiexec.exe 28 1732 msiexec.exe 29 1732 msiexec.exe 30 1732 msiexec.exe 31 1732 msiexec.exe 32 1732 msiexec.exe 33 1732 msiexec.exe 34 1732 msiexec.exe 35 1732 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2036 set thread context of 996 2036 notification.exe 27 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\PROGRA~3\msclop.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 996 notification.exe 1732 msiexec.exe 1732 msiexec.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
pid Process 996 notification.exe 996 notification.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1732 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 996 notification.exe Token: SeBackupPrivilege 996 notification.exe Token: SeRestorePrivilege 996 notification.exe Token: SeDebugPrivilege 1732 msiexec.exe Token: SeBackupPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2036 notification.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2036 wrote to memory of 996 2036 notification.exe 27 PID 2036 wrote to memory of 996 2036 notification.exe 27 PID 2036 wrote to memory of 996 2036 notification.exe 27 PID 2036 wrote to memory of 996 2036 notification.exe 27 PID 2036 wrote to memory of 996 2036 notification.exe 27 PID 2036 wrote to memory of 996 2036 notification.exe 27 PID 2036 wrote to memory of 996 2036 notification.exe 27 PID 2036 wrote to memory of 996 2036 notification.exe 27 PID 996 wrote to memory of 1732 996 notification.exe 28 PID 996 wrote to memory of 1732 996 notification.exe 28 PID 996 wrote to memory of 1732 996 notification.exe 28 PID 996 wrote to memory of 1732 996 notification.exe 28 PID 996 wrote to memory of 1732 996 notification.exe 28 PID 996 wrote to memory of 1732 996 notification.exe 28 PID 996 wrote to memory of 1732 996 notification.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\notification.exe"C:\Users\Admin\AppData\Local\Temp\notification.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\notification.exe"C:\Users\Admin\AppData\Local\Temp\notification.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-