be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939

General

Target

be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Size

314KB
MD5

27ce2a6a066f0ce67db11cc18c30d68e
SHA1

9c4c6ec5481a164d5cab80baae7328fd955a8f85
SHA256

be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939
SHA512

129c81e1a19abf56b2e4ec09d7d3adfd884ae3e346165d5d000f70823c1e324b228ad6b2ee471e678fe92ba92d6e179d39fbd57d2294ec83f4da6fd80ee960db
SSDEEP

3072:mAA/AfOJMv2vVojZ2acXvGuyZucSLJnsGdkydYI7lkMQEglaZLVnzxwvc7/fxo9F:vWMv2Y2xXvOZuRGydxZcAnzxwvc7nxL

Score

8^/10

evasion

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\153d0724	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\open	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\runas\command\ = "\"%1\" %*"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\runas\command\IsolatedCommand = "\"%1\" %*"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\start\command	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.exe\ = "mi"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\Content Type = "application/x-msdownload"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\open\command	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\iou.exe\" -a \"%1\" %*"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\runas\command	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\runas	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\ = "Application"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\DefaultIcon\ = "%1"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\start	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\start\command\ = "\"%1\" %*"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.exe	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\open\command\IsolatedCommand = "\"%1\" %*"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\DefaultIcon	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\mi\shell\start\command\IsolatedCommand = "\"%1\" %*"	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
1416	be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe

C:\Users\Admin\AppData\Local\Temp\be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe
"C:\Users\Admin\AppData\Local\Temp\be7ec94ecf0138d2e9b50aee1cde387147b68d65abaf26e7e19c27aabc989939.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1416

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-54-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/1416-55-0x00000000009B0000-0x0000000000A01AB0-memory.dmp

Filesize
326KB

Download
memory/1416-56-0x0000000003230000-0x0000000003338000-memory.dmp

Filesize
1.0MB

Download
memory/1416-57-0x00000000009B0000-0x0000000000A01AB0-memory.dmp

Filesize
326KB

Download

Analysis

Sharing