Analysis
-
max time kernel
241s -
max time network
335s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe
-
Size
392KB
-
MD5
7e4b64423396c2c65508fa9f89d2532f
-
SHA1
ee03314f4b2895965826f9f39af9be73a3e1e9f4
-
SHA256
a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f
-
SHA512
211c1f508a39e7058b9cb57c88f848cc7550d82707c48d3cb36f1c81f2799c6a9f2f4dba0e728668c3b5f282a6c940fae7c376e69f7d96f8465c3512e1a68bfd
-
SSDEEP
12288:Zd5sTH4JGqud/+GyVod/A0RIhKcGicLo:Zd5SSBGyVITRIhKz1L
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1176 F4D55F6500014973000C4E45B4EB2331.exe -
Deletes itself 1 IoCs
pid Process 1176 F4D55F6500014973000C4E45B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C4E45B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C4E45B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C4E45B4EB2331.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce F4D55F6500014973000C4E45B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000C4E45B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000C4E45B4EB2331\\F4D55F6500014973000C4E45B4EB2331.exe" F4D55F6500014973000C4E45B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1176 F4D55F6500014973000C4E45B4EB2331.exe 1176 F4D55F6500014973000C4E45B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 896 wrote to memory of 1176 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 28 PID 896 wrote to memory of 1176 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 28 PID 896 wrote to memory of 1176 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 28 PID 896 wrote to memory of 1176 896 a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe"C:\Users\Admin\AppData\Local\Temp\a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:896 -
C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe"C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1176
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392KB
MD57e4b64423396c2c65508fa9f89d2532f
SHA1ee03314f4b2895965826f9f39af9be73a3e1e9f4
SHA256a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f
SHA512211c1f508a39e7058b9cb57c88f848cc7550d82707c48d3cb36f1c81f2799c6a9f2f4dba0e728668c3b5f282a6c940fae7c376e69f7d96f8465c3512e1a68bfd
-
Filesize
392KB
MD57e4b64423396c2c65508fa9f89d2532f
SHA1ee03314f4b2895965826f9f39af9be73a3e1e9f4
SHA256a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f
SHA512211c1f508a39e7058b9cb57c88f848cc7550d82707c48d3cb36f1c81f2799c6a9f2f4dba0e728668c3b5f282a6c940fae7c376e69f7d96f8465c3512e1a68bfd
-
Filesize
392KB
MD57e4b64423396c2c65508fa9f89d2532f
SHA1ee03314f4b2895965826f9f39af9be73a3e1e9f4
SHA256a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f
SHA512211c1f508a39e7058b9cb57c88f848cc7550d82707c48d3cb36f1c81f2799c6a9f2f4dba0e728668c3b5f282a6c940fae7c376e69f7d96f8465c3512e1a68bfd
-
Filesize
392KB
MD57e4b64423396c2c65508fa9f89d2532f
SHA1ee03314f4b2895965826f9f39af9be73a3e1e9f4
SHA256a9e8ff51ca22a69a463e3da20f701b1c1f654035d6d3bb5b0440264a14ac518f
SHA512211c1f508a39e7058b9cb57c88f848cc7550d82707c48d3cb36f1c81f2799c6a9f2f4dba0e728668c3b5f282a6c940fae7c376e69f7d96f8465c3512e1a68bfd