Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe
-
Size
124KB
-
MD5
bba602f3628f39f7d62edaa80cfddfe5
-
SHA1
c71bbfb24984c162e59e2ffbb8be69a5153af28b
-
SHA256
c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca
-
SHA512
c6697b21b69b74da7d2e5cb1900eb95b4d4ed1d63172c956771821d960c7f3487039bd13fc6e049945c9d9db4cfb85e81a5d112758538e6e1ec0e40e33976200
-
SSDEEP
1536:iQOwPGF+Nn76jBwEMxqElwfGwCwFEMxqER6jBaNnU6j5zpIqq21XrH2b7Zm:B1PGsN72GwZrNb5x1b+A
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\542815328 = "C:\\PROGRA~3\\msvyx.exe" msiexec.exe -
Blocklisted process makes network request 27 IoCs
flow pid Process 1 944 msiexec.exe 2 944 msiexec.exe 3 944 msiexec.exe 5 944 msiexec.exe 7 944 msiexec.exe 9 944 msiexec.exe 11 944 msiexec.exe 13 944 msiexec.exe 15 944 msiexec.exe 18 944 msiexec.exe 19 944 msiexec.exe 20 944 msiexec.exe 21 944 msiexec.exe 22 944 msiexec.exe 23 944 msiexec.exe 24 944 msiexec.exe 25 944 msiexec.exe 26 944 msiexec.exe 27 944 msiexec.exe 28 944 msiexec.exe 29 944 msiexec.exe 30 944 msiexec.exe 31 944 msiexec.exe 32 944 msiexec.exe 33 944 msiexec.exe 34 944 msiexec.exe 35 944 msiexec.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 984 set thread context of 1520 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 27 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\PROGRA~3\msvyx.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 944 msiexec.exe 944 msiexec.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
pid Process 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe 944 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 944 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe Token: SeBackupPrivilege 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe Token: SeRestorePrivilege 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe Token: SeDebugPrivilege 944 msiexec.exe Token: SeBackupPrivilege 944 msiexec.exe Token: SeRestorePrivilege 944 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 984 wrote to memory of 1520 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 27 PID 984 wrote to memory of 1520 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 27 PID 984 wrote to memory of 1520 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 27 PID 984 wrote to memory of 1520 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 27 PID 984 wrote to memory of 1520 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 27 PID 984 wrote to memory of 1520 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 27 PID 984 wrote to memory of 1520 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 27 PID 984 wrote to memory of 1520 984 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 27 PID 1520 wrote to memory of 944 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 28 PID 1520 wrote to memory of 944 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 28 PID 1520 wrote to memory of 944 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 28 PID 1520 wrote to memory of 944 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 28 PID 1520 wrote to memory of 944 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 28 PID 1520 wrote to memory of 944 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 28 PID 1520 wrote to memory of 944 1520 c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe"C:\Users\Admin\AppData\Local\Temp\c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe"C:\Users\Admin\AppData\Local\Temp\c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-