Analysis
- max time kernel
184s - max time network
223s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
07/12/2022, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe
- Size 407KB
- Sample221207-dee8wacb6y
- SHA256 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994
- MD5 33f6895c82224fa10e83ddd274b97930
- SHA1 7854869de325b2fb23dff19c17fd846aa708ce6f
- SHA512 7818fa8b8f98d17e7ac7d69e7b802fe93ac16e96e0e227d1803d13d62466203df5e373617e6819d8fbad669c92f24ae789b5439c4b7c1b0b395315b6fd4fb1a6
- SSDEEP 6144:AcqtPNbzeJMTsyQv5lM/m6v7Fk4UgzvEahingoEzrH35X147d/e1UHWLWi3CGQxd:Ac4heFim6vPhz8ahFoEPE/eq8WiQmqb
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe - Disables taskbar notifications via registry modification
-
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Security Center\svc 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\svc 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\C49920B1E2340C8B0000C4985C1E1116 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\C49920B1E2340C8B0000C4985C1E1116 = "C:\\ProgramData\\C49920B1E2340C8B0000C4985C1E1116\\C49920B1E2340C8B0000C4985C1E1116.exe" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe 2892 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe"C:\Users\Admin\AppData\Local\Temp\83c2dd95cd3e2ca74463a7a72ad5b40dd2a587c6db69abc4050bfac8a970d994.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2892