Analysis
-
max time kernel
149s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
10-01-2023 02:19
Static task
static1
Behavioral task
behavioral1
Sample
a681fdf33264e7f340991b816e3cec6ac455db0a.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a681fdf33264e7f340991b816e3cec6ac455db0a.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
a681fdf33264e7f340991b816e3cec6ac455db0a.exe
-
Size
408KB
-
MD5
c6cf58f9cccc6dd123365d32af50e348
-
SHA1
a681fdf33264e7f340991b816e3cec6ac455db0a
-
SHA256
3e87745a25a634424d544e4fc4dba2d7f99f6c483aaa32dd6a8b293ec4f473b3
-
SHA512
cf52beee0cc649dd5cc06b49cb649b1380b0e236558c8370fc3a7ac23c8e03948df1f99986bd544969112a270a25c698e22606e121bb7d63f43902ec34e03f58
-
SSDEEP
12288:gqyuF2dxmh6ZfYqAlSnshDvDJIxFunmcqOOi:7smhmdshv90umq3
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1520 F4D55F6500014973000B9D42B4EB2331.exe -
Deletes itself 1 IoCs
pid Process 1520 F4D55F6500014973000B9D42B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc a681fdf33264e7f340991b816e3cec6ac455db0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc a681fdf33264e7f340991b816e3cec6ac455db0a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a681fdf33264e7f340991b816e3cec6ac455db0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B9D42B4EB2331.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000B9D42B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000B9D42B4EB2331\\F4D55F6500014973000B9D42B4EB2331.exe" F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1520 F4D55F6500014973000B9D42B4EB2331.exe 1520 F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1520 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 28 PID 1616 wrote to memory of 1520 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 28 PID 1616 wrote to memory of 1520 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 28 PID 1616 wrote to memory of 1520 1616 a681fdf33264e7f340991b816e3cec6ac455db0a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a681fdf33264e7f340991b816e3cec6ac455db0a.exe"C:\Users\Admin\AppData\Local\Temp\a681fdf33264e7f340991b816e3cec6ac455db0a.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe"C:\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\a681fdf33264e7f340991b816e3cec6ac455db0a.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1520
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5c6cf58f9cccc6dd123365d32af50e348
SHA1a681fdf33264e7f340991b816e3cec6ac455db0a
SHA2563e87745a25a634424d544e4fc4dba2d7f99f6c483aaa32dd6a8b293ec4f473b3
SHA512cf52beee0cc649dd5cc06b49cb649b1380b0e236558c8370fc3a7ac23c8e03948df1f99986bd544969112a270a25c698e22606e121bb7d63f43902ec34e03f58
-
Filesize
408KB
MD5c6cf58f9cccc6dd123365d32af50e348
SHA1a681fdf33264e7f340991b816e3cec6ac455db0a
SHA2563e87745a25a634424d544e4fc4dba2d7f99f6c483aaa32dd6a8b293ec4f473b3
SHA512cf52beee0cc649dd5cc06b49cb649b1380b0e236558c8370fc3a7ac23c8e03948df1f99986bd544969112a270a25c698e22606e121bb7d63f43902ec34e03f58
-
Filesize
408KB
MD5c6cf58f9cccc6dd123365d32af50e348
SHA1a681fdf33264e7f340991b816e3cec6ac455db0a
SHA2563e87745a25a634424d544e4fc4dba2d7f99f6c483aaa32dd6a8b293ec4f473b3
SHA512cf52beee0cc649dd5cc06b49cb649b1380b0e236558c8370fc3a7ac23c8e03948df1f99986bd544969112a270a25c698e22606e121bb7d63f43902ec34e03f58
-
Filesize
408KB
MD5c6cf58f9cccc6dd123365d32af50e348
SHA1a681fdf33264e7f340991b816e3cec6ac455db0a
SHA2563e87745a25a634424d544e4fc4dba2d7f99f6c483aaa32dd6a8b293ec4f473b3
SHA512cf52beee0cc649dd5cc06b49cb649b1380b0e236558c8370fc3a7ac23c8e03948df1f99986bd544969112a270a25c698e22606e121bb7d63f43902ec34e03f58