9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550

General

Target

9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Size

324KB
MD5

55ec8e791884ecf675216a103ce33f5d
SHA1

9089e572bd5b359f6b0d61119abc85435a83f91c
SHA256

9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550
SHA512

cb118a0cce6b572596060c29712fcea6a7d92146b014ddb473b66dbbb695124761530af099b4f44d22a4138f66f15d4efc71361227e62679fa42f73eb26f87ac
SSDEEP

6144:AA1eEeo0OdadBDCRaT0w0yMpWvlfwbBKdIawo0Kue6E:qCRTklf8raZLuRE

Score

8^/10

evasion

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\6f44cfb5	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\DefaultIcon	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\open\command	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\open	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\runas\command\ = "\"%1\" %*"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\start\command\ = "\"%1\" %*"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\start\command\IsolatedCommand = "\"%1\" %*"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.exe	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.exe\ = "upn"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\Content Type = "application/x-msdownload"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\open\command\IsolatedCommand = "\"%1\" %*"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\runas\command	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\runas\command\IsolatedCommand = "\"%1\" %*"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\start\command	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\ = "Application"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\DefaultIcon\ = "%1"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\runas	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\start	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\upn\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ebc.exe\" -a \"%1\" %*"	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
1396	9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe

C:\Users\Admin\AppData\Local\Temp\9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe
"C:\Users\Admin\AppData\Local\Temp\9cab819bd764c22aeb3c5922bc1729c35febe776dd3af3af8eacd853dcbf3550.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1396-55-0x0000000001370000-0x00000000013CA1C0-memory.dmp

Filesize
360KB

Download
memory/1396-56-0x00000000009D0000-0x0000000000AD8000-memory.dmp

Filesize
1.0MB

Download
memory/1396-57-0x0000000001370000-0x00000000013CA1C0-memory.dmp

Filesize
360KB

Download

Analysis

Sharing