776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61

General

Target

776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe
Size

107KB
MD5

08ac06804632be95198b125366c3b92b
SHA1

0a60a176075f26992835803880bfc0667a716e5a
SHA256

776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61
SHA512

779adf4641f520e4853aca4492d51a8879d0953335465cc52ca17ae97af924c2c2753027ec7b0f4f715cf9dc88b8ce8e617790d1cf1bdd12986eeaf30e3dbf57
SSDEEP

3072:6cjasckPndHT3Zg1o+syvaUcWWgH3BGAp:6G1ckPnF+ZfNH3D

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msiexec.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\3301207138 = "C:\\PROGRA~3\\msbqzj.exe"	msiexec.exe

Blocklisted process makes network request 12 IoCs

flow	pid	Process
2	980	msiexec.exe
3	980	msiexec.exe
4	980	msiexec.exe
6	980	msiexec.exe
7	980	msiexec.exe
8	980	msiexec.exe
10	980	msiexec.exe
11	980	msiexec.exe
12	980	msiexec.exe
14	980	msiexec.exe
15	980	msiexec.exe
16	980	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\WINE	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\WINE	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~3\msbqzj.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe
980	msiexec.exe
980	msiexec.exe

Suspicious behavior: MapViewOfSection 25 IoCs

pid	Process
1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe
1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
980	msiexec.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe
Token: SeBackupPrivilege	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe
Token: SeRestorePrivilege	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe
Token: SeDebugPrivilege	980	msiexec.exe
Token: SeBackupPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 980	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe	27
PID 1940 wrote to memory of 980	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe	27
PID 1940 wrote to memory of 980	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe	27
PID 1940 wrote to memory of 980	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe	27
PID 1940 wrote to memory of 980	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe	27
PID 1940 wrote to memory of 980	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe	27
PID 1940 wrote to memory of 980	1940	776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe	27

C:\Users\Admin\AppData\Local\Temp\776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe
"C:\Users\Admin\AppData\Local\Temp\776ec95d65b263a1f5937452c5db664578f93e1ecb91f4d64954d3c069e69e61.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\system32\msiexec.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Adds policy Run key to start application
  - Blocklisted process makes network request
  - Identifies Wine through registry keys
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Hidden Files and Directories

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-57-0x0000000000000000-mapping.dmp

Download
memory/980-60-0x0000000000B30000-0x0000000000B44000-memory.dmp

Filesize
80KB

Download
memory/980-61-0x0000000000090000-0x0000000000098000-memory.dmp

Filesize
32KB

Download
memory/980-62-0x000000007EF90000-0x000000007EF99000-memory.dmp

Filesize
36KB

Download
memory/1940-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1940-55-0x00000000021B0000-0x000000000233D000-memory.dmp

Filesize
1.6MB

Download
memory/1940-56-0x000000007EF90000-0x000000007EF99000-memory.dmp

Filesize
36KB

Download
memory/1940-59-0x000000007EF90000-0x000000007EF99000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads