Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e1c7f396911598d5bd19f8181ecea80.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e1c7f396911598d5bd19f8181ecea80.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
1e1c7f396911598d5bd19f8181ecea80.exe
-
Size
4KB
-
MD5
1e1c7f396911598d5bd19f8181ecea80
-
SHA1
da5a7df614bdf8770deafdc0d7af33e6bc1a5dd3
-
SHA256
bd3fd823f57c2aa4e53f84bad73cf8fb6a7579758004ffd02a733098471190be
-
SHA512
01676fe85da18ad79bc946e992661a9d11abd622a433da771fcf21667b430c91a3d47986590e2f05c77cd6ce86bff9d0b5dd936eae7babe97dc1e499cc9180ed
-
SSDEEP
96:rmd9qotlyazzYZ6HcPQu2SECP6GNToc82:ad9qS3YZ6QQPSnVTo52
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1e1c7f396911598d5bd19f8181ecea80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1e1c7f396911598d5bd19f8181ecea80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1e1c7f396911598d5bd19f8181ecea80.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1e1c7f396911598d5bd19f8181ecea80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1e1c7f396911598d5bd19f8181ecea80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1e1c7f396911598d5bd19f8181ecea80.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\KernelCheck = "C:\\Windows\\system32\\1e1c7f396911598d5bd19f8181ecea80.exe" 1e1c7f396911598d5bd19f8181ecea80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KernelCheck = "C:\\Windows\\system32\\1e1c7f396911598d5bd19f8181ecea80.exe" 1e1c7f396911598d5bd19f8181ecea80.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\1e1c7f396911598d5bd19f8181ecea80.exe 1e1c7f396911598d5bd19f8181ecea80.exe File opened for modification C:\Windows\SysWOW64\1e1c7f396911598d5bd19f8181ecea80.exe 1e1c7f396911598d5bd19f8181ecea80.exe File created C:\Windows\SysWOW64\svc.exe 1e1c7f396911598d5bd19f8181ecea80.exe File created C:\Windows\SysWOW64\dllcache\explorer.exe 1e1c7f396911598d5bd19f8181ecea80.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\wininit.ini 1e1c7f396911598d5bd19f8181ecea80.exe File created C:\Windows\ServicePackFiles\i386\explorer.exe 1e1c7f396911598d5bd19f8181ecea80.exe File created C:\Windows\explorer.new 1e1c7f396911598d5bd19f8181ecea80.exe File opened for modification C:\Windows\explorer.exe 1e1c7f396911598d5bd19f8181ecea80.exe File opened for modification C:\Windows\explorer.new 1e1c7f396911598d5bd19f8181ecea80.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2884 explorer.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 2124 1e1c7f396911598d5bd19f8181ecea80.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2884 2124 1e1c7f396911598d5bd19f8181ecea80.exe 28 PID 2124 wrote to memory of 2884 2124 1e1c7f396911598d5bd19f8181ecea80.exe 28 PID 2124 wrote to memory of 2884 2124 1e1c7f396911598d5bd19f8181ecea80.exe 28 PID 2124 wrote to memory of 2884 2124 1e1c7f396911598d5bd19f8181ecea80.exe 28 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e1c7f396911598d5bd19f8181ecea80.exe"C:\Users\Admin\AppData\Local\Temp\1e1c7f396911598d5bd19f8181ecea80.exe"1⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2884
-