Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 03:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f3c3c4bcbf9858699e10522c2dd2d85.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f3c3c4bcbf9858699e10522c2dd2d85.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
4f3c3c4bcbf9858699e10522c2dd2d85.exe
-
Size
404KB
-
MD5
4f3c3c4bcbf9858699e10522c2dd2d85
-
SHA1
0feef66f4212369dedd6249fb5c67cddc24b008b
-
SHA256
26c0dfa4a1884113d0d2e1bdd4de0173e1846345c9867a81423859c6c63f0912
-
SHA512
b352d043e3f90a4e9679691701f83e37a93e3338f2efbc25d7cb3a326230541780b3da0c080ef8fa51f60c64298b417627d4c8e7120ad8ec8d0d4e79d2547689
-
SSDEEP
6144:YMoXMPaGQy9U5IqbuNF/yl+JEpSCW1bJJQbhsYuuE6YOaAHXGbGOJg6W9:tP19U5I3Ql6CSI9uFFAuAv9
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6AEB00014973000C5A72B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6AEB00014973000C5A72B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6AEB00014973000C5A72B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6AEB00014973000C5A72B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6AEB00014973000C5A72B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 1704 043A6AEB00014973000C5A72B4EB2331.exe -
Executes dropped EXE 1 IoCs
pid Process 1704 043A6AEB00014973000C5A72B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6AEB00014973000C5A72B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6AEB00014973000C5A72B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6AEB00014973000C5A72B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 043A6AEB00014973000C5A72B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4f3c3c4bcbf9858699e10522c2dd2d85.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 4f3c3c4bcbf9858699e10522c2dd2d85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6AEB00014973000C5A72B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 043A6AEB00014973000C5A72B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6AEB00014973000C5A72B4EB2331.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6AEB00014973000C5A72B4EB2331 = "C:\\ProgramData\\043A6AEB00014973000C5A72B4EB2331\\043A6AEB00014973000C5A72B4EB2331.exe" 043A6AEB00014973000C5A72B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1704 043A6AEB00014973000C5A72B4EB2331.exe 1704 043A6AEB00014973000C5A72B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 1704 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 21 PID 2540 wrote to memory of 1704 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 21 PID 2540 wrote to memory of 1704 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 21 PID 2540 wrote to memory of 1704 2540 4f3c3c4bcbf9858699e10522c2dd2d85.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f3c3c4bcbf9858699e10522c2dd2d85.exe"C:\Users\Admin\AppData\Local\Temp\4f3c3c4bcbf9858699e10522c2dd2d85.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\ProgramData\043A6AEB00014973000C5A72B4EB2331\043A6AEB00014973000C5A72B4EB2331.exe"C:\ProgramData\043A6AEB00014973000C5A72B4EB2331\043A6AEB00014973000C5A72B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\4f3c3c4bcbf9858699e10522c2dd2d85.exe"2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD533304b7c08a05b90004a97e9944cdd73
SHA11c6103ca3cf627f674a34123c9d36dd0bb61a32f
SHA2562bbf3f865ada6bc0ca76465d4f460c5d20102d67c0ac0130c3a2a0a79a3a34bf
SHA512fdfb01a453cf18d186ca2d3004f2794e5447bf641186e5e03e70a6c376fa112906bbf371fa0e3a068a1457b1a199315f70d60a76658f82128d274a309c45d49d