Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1794ef4682b7da5d8ad33dcc87ffe2f8.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1794ef4682b7da5d8ad33dcc87ffe2f8.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
1794ef4682b7da5d8ad33dcc87ffe2f8.exe
-
Size
404KB
-
MD5
1794ef4682b7da5d8ad33dcc87ffe2f8
-
SHA1
e604ec384414d2978d03b3593bfa687b7cf95fc0
-
SHA256
f95a8477cda36e602b71b795490b1069fcadc615b56ad4c3ec1fdb8d3efb94c3
-
SHA512
21c81db471884fcde044c78e55ac4e6d58854dd90b2da99787acc6825690e386ff1955484498b7e70e34f5914391d1cade86ea74a5499bd876bf289256c02f73
-
SSDEEP
6144:geFCiXX0ZkOiRQgTAuzjcNXx6C2mkismbuXdZoFOSD1XdJhuvdo3gXaV69:geFP2kOiRQTDlLfD1N1g46
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 2684 043A6AEB00014973000A4136B4EB2331.exe -
Executes dropped EXE 1 IoCs
pid Process 2684 043A6AEB00014973000A4136B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1794ef4682b7da5d8ad33dcc87ffe2f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6AEB00014973000A4136B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6AEB00014973000A4136B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6AEB00014973000A4136B4EB2331.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6AEB00014973000A4136B4EB2331 = "C:\\ProgramData\\043A6AEB00014973000A4136B4EB2331\\043A6AEB00014973000A4136B4EB2331.exe" 043A6AEB00014973000A4136B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2684 043A6AEB00014973000A4136B4EB2331.exe 2684 043A6AEB00014973000A4136B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2684 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 28 PID 3016 wrote to memory of 2684 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 28 PID 3016 wrote to memory of 2684 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 28 PID 3016 wrote to memory of 2684 3016 1794ef4682b7da5d8ad33dcc87ffe2f8.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1794ef4682b7da5d8ad33dcc87ffe2f8.exe"C:\Users\Admin\AppData\Local\Temp\1794ef4682b7da5d8ad33dcc87ffe2f8.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\ProgramData\043A6AEB00014973000A4136B4EB2331\043A6AEB00014973000A4136B4EB2331.exe"C:\ProgramData\043A6AEB00014973000A4136B4EB2331\043A6AEB00014973000A4136B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\1794ef4682b7da5d8ad33dcc87ffe2f8.exe"2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
404KB
MD51794ef4682b7da5d8ad33dcc87ffe2f8
SHA1e604ec384414d2978d03b3593bfa687b7cf95fc0
SHA256f95a8477cda36e602b71b795490b1069fcadc615b56ad4c3ec1fdb8d3efb94c3
SHA51221c81db471884fcde044c78e55ac4e6d58854dd90b2da99787acc6825690e386ff1955484498b7e70e34f5914391d1cade86ea74a5499bd876bf289256c02f73