Analysis
-
max time kernel
149s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe
Resource
win7-20220901-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe
-
Size
408KB
-
MD5
56161055d98ae04273f55ac11e4acff1
-
SHA1
4666231c42a7e4bccf895ce6d602a08fb265772b
-
SHA256
75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0
-
SHA512
b551c5ff4d6dd63d728eff84cc27d61ba43aacc74ec2e58ae1cb68ba34daf944e7b7d9b10af94049de575f7acc7dd763bbe9a34bb7b42f9965069818b91ded02
-
SSDEEP
12288:q7JvmomZjZ88IZ3aeYLX/FWTDD/INtFFuv:OmDIZ3aeq9qDANL4v
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C7881B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1088 F4D55F6500014973000C7881B4EB2331.exe -
Deletes itself 1 IoCs
pid Process 1088 F4D55F6500014973000C7881B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000C7881B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000C7881B4EB2331.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000C7881B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000C7881B4EB2331\\F4D55F6500014973000C7881B4EB2331.exe" F4D55F6500014973000C7881B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1088 F4D55F6500014973000C7881B4EB2331.exe 1088 F4D55F6500014973000C7881B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1340 wrote to memory of 1088 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 27 PID 1340 wrote to memory of 1088 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 27 PID 1340 wrote to memory of 1088 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 27 PID 1340 wrote to memory of 1088 1340 75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe"C:\Users\Admin\AppData\Local\Temp\75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\ProgramData\F4D55F6500014973000C7881B4EB2331\F4D55F6500014973000C7881B4EB2331.exe"C:\ProgramData\F4D55F6500014973000C7881B4EB2331\F4D55F6500014973000C7881B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\75ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1088
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD556161055d98ae04273f55ac11e4acff1
SHA14666231c42a7e4bccf895ce6d602a08fb265772b
SHA25675ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0
SHA512b551c5ff4d6dd63d728eff84cc27d61ba43aacc74ec2e58ae1cb68ba34daf944e7b7d9b10af94049de575f7acc7dd763bbe9a34bb7b42f9965069818b91ded02
-
Filesize
408KB
MD556161055d98ae04273f55ac11e4acff1
SHA14666231c42a7e4bccf895ce6d602a08fb265772b
SHA25675ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0
SHA512b551c5ff4d6dd63d728eff84cc27d61ba43aacc74ec2e58ae1cb68ba34daf944e7b7d9b10af94049de575f7acc7dd763bbe9a34bb7b42f9965069818b91ded02
-
Filesize
408KB
MD556161055d98ae04273f55ac11e4acff1
SHA14666231c42a7e4bccf895ce6d602a08fb265772b
SHA25675ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0
SHA512b551c5ff4d6dd63d728eff84cc27d61ba43aacc74ec2e58ae1cb68ba34daf944e7b7d9b10af94049de575f7acc7dd763bbe9a34bb7b42f9965069818b91ded02
-
Filesize
408KB
MD556161055d98ae04273f55ac11e4acff1
SHA14666231c42a7e4bccf895ce6d602a08fb265772b
SHA25675ba3d4e362dd9bae46d2e2232bfc2a3b6a7273d64bbf070725f5863957999f0
SHA512b551c5ff4d6dd63d728eff84cc27d61ba43aacc74ec2e58ae1cb68ba34daf944e7b7d9b10af94049de575f7acc7dd763bbe9a34bb7b42f9965069818b91ded02