a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be

General

Target

a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Size

311KB
MD5

4524b76162e308e95d8d385a81a255bb
SHA1

71f8fa189f574bf57282620943547b546d8f024f
SHA256

a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be
SHA512

5309561dc865a8b9237aed6b367cd9ebd293e15622d0048fe06c651c0ad3fadf49509837eac79b77e5baa7978d82126904871209a637c7cb1e94d16a2c3f0d6b
SSDEEP

3072:4LkG2fULlnJZ445pVO6mcc3XB1CmxOu7KHNwEcv4v6vOouKetY9U4/uXby+:skGCUTZ/53jmcYGk17KOEymo3etYhmb

Score

8^/10

evasion

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\4ff7a40a	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\open	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\runas\command\IsolatedCommand = "\"%1\" %*"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.exe\ = "jnj"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\DefaultIcon	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\open\command	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\lhp.exe\" -a \"%1\" %*"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\runas\command\ = "\"%1\" %*"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.exe	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\start\command\ = "\"%1\" %*"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\Content Type = "application/x-msdownload"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\DefaultIcon\ = "%1"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\open\command\IsolatedCommand = "\"%1\" %*"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\runas\command	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\runas	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\start\command	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\ = "Application"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\start\command\IsolatedCommand = "\"%1\" %*"	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\jnj\shell\start	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
1380	a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe

C:\Users\Admin\AppData\Local\Temp\a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe
"C:\Users\Admin\AppData\Local\Temp\a6ad872675415e22bd4488a10504d2c69d6707289feecd2cbf6decd87fec19be.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1380-55-0x00000000011E0000-0x0000000001230A30-memory.dmp

Filesize
322KB

Download
memory/1380-56-0x0000000001020000-0x000000000117C000-memory.dmp

Filesize
1.4MB

Download
memory/1380-57-0x00000000011E0000-0x0000000001230A30-memory.dmp

Filesize
322KB

Download
memory/1380-58-0x0000000001020000-0x000000000117C000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing