Analysis
-
max time kernel
193s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe
-
Size
420KB
-
MD5
cd6c44d29e0b44a58038762570bc64a0
-
SHA1
3f5d5367986d586bdd4f39a9a81420e9459ae8d1
-
SHA256
cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce
-
SHA512
9d8163335f8b5d7efdbeca51136790a84f73485c2e54777730059f67186b89badd165a7a3120ea65299fd5e2b82dab08e445ef3f1c7be11a508793bee936d761
-
SSDEEP
12288:hk6yMn402LZYm+rGxePQgVAgMNZWmeO9kASA8KI:fxm060AgMNZWKqA8KI
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2028 F4D55F6500014973000B4090B4EB2331.exe -
Deletes itself 1 IoCs
pid Process 2028 F4D55F6500014973000B4090B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B4090B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B4090B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B4090B4EB2331.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000B4090B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000B4090B4EB2331\\F4D55F6500014973000B4090B4EB2331.exe" F4D55F6500014973000B4090B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2028 F4D55F6500014973000B4090B4EB2331.exe 2028 F4D55F6500014973000B4090B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1492 wrote to memory of 2028 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 28 PID 1492 wrote to memory of 2028 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 28 PID 1492 wrote to memory of 2028 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 28 PID 1492 wrote to memory of 2028 1492 cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe"C:\Users\Admin\AppData\Local\Temp\cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe"C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2028
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
MD5cd6c44d29e0b44a58038762570bc64a0
SHA13f5d5367986d586bdd4f39a9a81420e9459ae8d1
SHA256cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce
SHA5129d8163335f8b5d7efdbeca51136790a84f73485c2e54777730059f67186b89badd165a7a3120ea65299fd5e2b82dab08e445ef3f1c7be11a508793bee936d761
-
Filesize
420KB
MD5cd6c44d29e0b44a58038762570bc64a0
SHA13f5d5367986d586bdd4f39a9a81420e9459ae8d1
SHA256cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce
SHA5129d8163335f8b5d7efdbeca51136790a84f73485c2e54777730059f67186b89badd165a7a3120ea65299fd5e2b82dab08e445ef3f1c7be11a508793bee936d761
-
Filesize
420KB
MD5cd6c44d29e0b44a58038762570bc64a0
SHA13f5d5367986d586bdd4f39a9a81420e9459ae8d1
SHA256cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce
SHA5129d8163335f8b5d7efdbeca51136790a84f73485c2e54777730059f67186b89badd165a7a3120ea65299fd5e2b82dab08e445ef3f1c7be11a508793bee936d761
-
Filesize
420KB
MD5cd6c44d29e0b44a58038762570bc64a0
SHA13f5d5367986d586bdd4f39a9a81420e9459ae8d1
SHA256cc84ecbdeb724be3ccaad15fc0b6c95606123c6b33fbed8ca8d0a5d28e8bf2ce
SHA5129d8163335f8b5d7efdbeca51136790a84f73485c2e54777730059f67186b89badd165a7a3120ea65299fd5e2b82dab08e445ef3f1c7be11a508793bee936d761