Overview

overview

10

Static

static

813a52b61e...9f.exe

windows7-x64

10

813a52b61e...9f.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 13:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    813a52b61ed1b12cc5161ad72165fd63a1a96bd8ba4169a999eca120c965df9f.exe

  • Size

    296KB

  • MD5

    07e6507e1a454951d92043133e0ae6f4

  • SHA1

    fed146d6fff888cbb8f66d696799c046cbfaa35a

  • SHA256

    813a52b61ed1b12cc5161ad72165fd63a1a96bd8ba4169a999eca120c965df9f

  • SHA512

    7b97fe203dfee4c9fb138fda720a881da182c1434dc1c9e48deb44b251124e15d1adbe14066fd5894d9cb51640386bf736b9d698d922a2b7b25a6ef858761879

  • SSDEEP

    6144:yx+pdQKTZfeyRYUh/GgtnmJxzUH2zvP6srbUxhaV3P2N6rP:yx+pdQUxeyRzdGgtmJxzs2rP6q6oV3P5

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 17 IoCs
    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\813a52b61ed1b12cc5161ad72165fd63a1a96bd8ba4169a999eca120c965df9f.exe
    "C:\Users\Admin\AppData\Local\Temp\813a52b61ed1b12cc5161ad72165fd63a1a96bd8ba4169a999eca120c965df9f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\mxi.exe
      "C:\Users\Admin\AppData\Local\mxi.exe" -gav C:\Users\Admin\AppData\Local\Temp\813a52b61ed1b12cc5161ad72165fd63a1a96bd8ba4169a999eca120c965df9f.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Deletes itself
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1720
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1976
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x5a0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1788

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\mxi.exe
          Filesize

          296KB

          MD5

          ce7fec089e664c21c23fca669b7d9aa2

          SHA1

          0cda6a87df3d37f65518309d6d12bdfef498f966

          SHA256

          b367e62495277ef15fb0874f9b802cd5c72b6c25e8e82d92b290b11cad24b97f

          SHA512

          f65a9a87464ac67efab85ed1b83b958afcb8d3beaaae0a5692266b8f8f559b427d1361d002645052051226986d8eb7899caa1020ab3c1494d037508c978ec87c

          Download Submit

        • C:\Users\Admin\AppData\Local\mxi.exe
          Filesize

          296KB

          MD5

          ce7fec089e664c21c23fca669b7d9aa2

          SHA1

          0cda6a87df3d37f65518309d6d12bdfef498f966

          SHA256

          b367e62495277ef15fb0874f9b802cd5c72b6c25e8e82d92b290b11cad24b97f

          SHA512

          f65a9a87464ac67efab85ed1b83b958afcb8d3beaaae0a5692266b8f8f559b427d1361d002645052051226986d8eb7899caa1020ab3c1494d037508c978ec87c

          Download Submit

        • \Users\Admin\AppData\Local\mxi.exe
          Filesize

          296KB

          MD5

          ce7fec089e664c21c23fca669b7d9aa2

          SHA1

          0cda6a87df3d37f65518309d6d12bdfef498f966

          SHA256

          b367e62495277ef15fb0874f9b802cd5c72b6c25e8e82d92b290b11cad24b97f

          SHA512

          f65a9a87464ac67efab85ed1b83b958afcb8d3beaaae0a5692266b8f8f559b427d1361d002645052051226986d8eb7899caa1020ab3c1494d037508c978ec87c

          Download Submit

        • \Users\Admin\AppData\Local\mxi.exe
          Filesize

          296KB

          MD5

          ce7fec089e664c21c23fca669b7d9aa2

          SHA1

          0cda6a87df3d37f65518309d6d12bdfef498f966

          SHA256

          b367e62495277ef15fb0874f9b802cd5c72b6c25e8e82d92b290b11cad24b97f

          SHA512

          f65a9a87464ac67efab85ed1b83b958afcb8d3beaaae0a5692266b8f8f559b427d1361d002645052051226986d8eb7899caa1020ab3c1494d037508c978ec87c

          Download Submit

        • memory/1492-58-0x0000000002270000-0x0000000002527000-memory.dmp

          Filesize

          2.7MB

          Download

        • memory/1492-54-0x0000000000220000-0x0000000000229000-memory.dmp

          Filesize

          36KB

          Download

        • memory/1492-57-0x0000000000230000-0x0000000000236000-memory.dmp

          Filesize

          24KB

          Download

        • memory/1492-56-0x0000000000400000-0x00000000005F6000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/1492-63-0x0000000000400000-0x00000000005F6000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/1492-55-0x0000000075451000-0x0000000075453000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1720-68-0x0000000000230000-0x0000000000236000-memory.dmp

          Filesize

          24KB

          Download

        • memory/1720-67-0x0000000000400000-0x00000000005F6000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/1720-69-0x0000000074711000-0x0000000074713000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1720-70-0x0000000000400000-0x00000000005F6000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/1976-64-0x000007FEFB7D1000-0x000007FEFB7D3000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1976-71-0x0000000002A70000-0x0000000002A80000-memory.dmp

          Filesize

          64KB

          Download