Analysis
-
max time kernel
143s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1be529fecba6aed396271a7f122fd80d.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1be529fecba6aed396271a7f122fd80d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
1be529fecba6aed396271a7f122fd80d.exe
-
Size
432KB
-
MD5
1be529fecba6aed396271a7f122fd80d
-
SHA1
2a4248f2b0e5044fde0dfb7b9b51bdd75c24f750
-
SHA256
845c8251bdc56b171f741f4cce7eca21709fcf436874df97eddcb3f69df9a68e
-
SHA512
34990afca3651956ee5bc0c001a9c4b275d43b585f75006688661d74a11dd0c0c0283122b013d9722cdec3a11a08e85f050527ff30455abc252f84361cf4a18b
-
SSDEEP
12288:TZ8sVivGAsHU7zu2YRgOkHUlGCP169Yx1a3aUeur+r:F+v7zuRRflGC4iXCqur2
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1be529fecba6aed396271a7f122fd80d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1be529fecba6aed396271a7f122fd80d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1be529fecba6aed396271a7f122fd80d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1be529fecba6aed396271a7f122fd80d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6A5B00014973000C0C69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1be529fecba6aed396271a7f122fd80d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6A5B00014973000C0C69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6A5B00014973000C0C69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6A5B00014973000C0C69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6A5B00014973000C0C69B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 2372 043A6A5B00014973000C0C69B4EB2331.exe -
Executes dropped EXE 1 IoCs
pid Process 2372 043A6A5B00014973000C0C69B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 1948 1be529fecba6aed396271a7f122fd80d.exe 1948 1be529fecba6aed396271a7f122fd80d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6A5B00014973000C0C69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6A5B00014973000C0C69B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 043A6A5B00014973000C0C69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1be529fecba6aed396271a7f122fd80d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6A5B00014973000C0C69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6A5B00014973000C0C69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1be529fecba6aed396271a7f122fd80d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 043A6A5B00014973000C0C69B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 1be529fecba6aed396271a7f122fd80d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1be529fecba6aed396271a7f122fd80d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1be529fecba6aed396271a7f122fd80d.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 1be529fecba6aed396271a7f122fd80d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6A5B00014973000C0C69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1be529fecba6aed396271a7f122fd80d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6A5B00014973000C0C69B4EB2331 = "C:\\ProgramData\\043A6A5B00014973000C0C69B4EB2331\\043A6A5B00014973000C0C69B4EB2331.exe" 043A6A5B00014973000C0C69B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1948 1be529fecba6aed396271a7f122fd80d.exe 1948 1be529fecba6aed396271a7f122fd80d.exe 1948 1be529fecba6aed396271a7f122fd80d.exe 1948 1be529fecba6aed396271a7f122fd80d.exe 1948 1be529fecba6aed396271a7f122fd80d.exe 1948 1be529fecba6aed396271a7f122fd80d.exe 1948 1be529fecba6aed396271a7f122fd80d.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2372 043A6A5B00014973000C0C69B4EB2331.exe 2372 043A6A5B00014973000C0C69B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2372 1948 1be529fecba6aed396271a7f122fd80d.exe 17 PID 1948 wrote to memory of 2372 1948 1be529fecba6aed396271a7f122fd80d.exe 17 PID 1948 wrote to memory of 2372 1948 1be529fecba6aed396271a7f122fd80d.exe 17 PID 1948 wrote to memory of 2372 1948 1be529fecba6aed396271a7f122fd80d.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\1be529fecba6aed396271a7f122fd80d.exe"C:\Users\Admin\AppData\Local\Temp\1be529fecba6aed396271a7f122fd80d.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\ProgramData\043A6A5B00014973000C0C69B4EB2331\043A6A5B00014973000C0C69B4EB2331.exe"C:\ProgramData\043A6A5B00014973000C0C69B4EB2331\043A6A5B00014973000C0C69B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\1be529fecba6aed396271a7f122fd80d.exe"2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD51d6dfe3de011274880f6da407fcf654b
SHA1efa7fed615ffc36f5f9c22a05781f5e4834f60a7
SHA256b52945c035368ecdb327d5387a90aa9ea03aa401f01e800f4f3bb8c53d70fa7f
SHA512279a7dc624d7aa88962f51a4c2ec1398ae0abf113a867ed173ea21439c6117016f62054360de2d6c38c2fce07beeccd0774c1f2eb3386ececbe845cb7dee987c
-
Filesize
96KB
MD543ab9ed0446a21ce9e70e6eea252ff3d
SHA153dc83e76f0f8c90629836d4450982ae10eb32f7
SHA2561815a886df4c5b65c44f559affa9d1068cb64bd118bcba08a477dba6740bd20f
SHA512e760d0a1d32a07e69b25764d1dd81283342053e46f6b75b5ecdc1c52806752e8680f3c2e763097e7dca424f6cf13f20f9dff3db74f62653a547376002115daeb