ba4568175950b5113ba77dd77ed6d056b177d71d379e322773bd6af89ab2e4dd

General

Target

a33422028510cbe1381f556208fb46b2.exe
Size

44KB
MD5

a33422028510cbe1381f556208fb46b2
SHA1

a6f7075faa0e6c318ab0930fa0b02e485e2c1506
SHA256

ba4568175950b5113ba77dd77ed6d056b177d71d379e322773bd6af89ab2e4dd
SHA512

d0e068d18c23198620460ebcbba03ccb6a1f958336ae02469c5e0ca4f19cf3c760e1af9000b87e8dcbd61f7bab28164a8876121467ba6b372303e08619620b8c
SSDEEP

768:phQz3L3E539AyQSxqdUqWRVQWzu2z8jixU9hFbMjBnND5jlWdp1X6OE7:pQ3L3E5tAhSxQ8RVQWDz8j2kh+BLjodF

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

msnliveq.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	msnliveq.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msnliveq.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	msnliveq.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Microsoft Messenger Update = "C:\\Users\\Admin\\AppData\\Roaming\\msnliveq.exe"	msnliveq.exe

Executes dropped EXE 2 IoCs

Processes:

msnliveq.exemsnliveq.exe

pid process

4152 msnliveq.exe
3900 msnliveq.exe

pid	process
4152	msnliveq.exe
3900	msnliveq.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1116-0-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/1116-6-0x0000000000400000-0x0000000000426000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\msnliveq.exe	upx
behavioral2/memory/4152-13-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4152-22-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msnliveq.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Messenger Update = "C:\\Users\\Admin\\AppData\\Roaming\\msnliveq.exe"	msnliveq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Messenger Update = "C:\\Users\\Admin\\AppData\\Roaming\\msnliveq.exe"	msnliveq.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

a33422028510cbe1381f556208fb46b2.exemsnliveq.exe

description	pid	process	target process
PID 1116 set thread context of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 4152 set thread context of 3900	4152	msnliveq.exe	msnliveq.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

a33422028510cbe1381f556208fb46b2.exemsnliveq.exe

pid	process
2640	a33422028510cbe1381f556208fb46b2.exe
2640	a33422028510cbe1381f556208fb46b2.exe
3900	msnliveq.exe
3900	msnliveq.exe
3900	msnliveq.exe
3900	msnliveq.exe
3900	msnliveq.exe
3900	msnliveq.exe
3900	msnliveq.exe
3900	msnliveq.exe
3900	msnliveq.exe
3900	msnliveq.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a33422028510cbe1381f556208fb46b2.exemsnliveq.exe

pid process

1116 a33422028510cbe1381f556208fb46b2.exe
4152 msnliveq.exe

pid	process
1116	a33422028510cbe1381f556208fb46b2.exe
4152	msnliveq.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

a33422028510cbe1381f556208fb46b2.exea33422028510cbe1381f556208fb46b2.exemsnliveq.exe

description	pid	process	target process
PID 1116 wrote to memory of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 1116 wrote to memory of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 1116 wrote to memory of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 1116 wrote to memory of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 1116 wrote to memory of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 1116 wrote to memory of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 1116 wrote to memory of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 1116 wrote to memory of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 1116 wrote to memory of 2640	1116	a33422028510cbe1381f556208fb46b2.exe	a33422028510cbe1381f556208fb46b2.exe
PID 2640 wrote to memory of 4152	2640	a33422028510cbe1381f556208fb46b2.exe	msnliveq.exe
PID 2640 wrote to memory of 4152	2640	a33422028510cbe1381f556208fb46b2.exe	msnliveq.exe
PID 2640 wrote to memory of 4152	2640	a33422028510cbe1381f556208fb46b2.exe	msnliveq.exe
PID 4152 wrote to memory of 3900	4152	msnliveq.exe	msnliveq.exe
PID 4152 wrote to memory of 3900	4152	msnliveq.exe	msnliveq.exe
PID 4152 wrote to memory of 3900	4152	msnliveq.exe	msnliveq.exe
PID 4152 wrote to memory of 3900	4152	msnliveq.exe	msnliveq.exe
PID 4152 wrote to memory of 3900	4152	msnliveq.exe	msnliveq.exe
PID 4152 wrote to memory of 3900	4152	msnliveq.exe	msnliveq.exe
PID 4152 wrote to memory of 3900	4152	msnliveq.exe	msnliveq.exe
PID 4152 wrote to memory of 3900	4152	msnliveq.exe	msnliveq.exe
PID 4152 wrote to memory of 3900	4152	msnliveq.exe	msnliveq.exe

C:\Users\Admin\AppData\Local\Temp\a33422028510cbe1381f556208fb46b2.exe
"C:\Users\Admin\AppData\Local\Temp\a33422028510cbe1381f556208fb46b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Local\Temp\a33422028510cbe1381f556208fb46b2.exe
"C:\Users\Admin\AppData\Local\Temp\a33422028510cbe1381f556208fb46b2.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640

C:\Users\Admin\AppData\Roaming\msnliveq.exe
"C:\Users\Admin\AppData\Roaming\msnliveq.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152

C:\Users\Admin\AppData\Roaming\msnliveq.exe
"C:\Users\Admin\AppData\Roaming\msnliveq.exe"
4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3900

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\msnliveq.exe
Filesize
44KB

MD5
a33422028510cbe1381f556208fb46b2

SHA1
a6f7075faa0e6c318ab0930fa0b02e485e2c1506

SHA256
ba4568175950b5113ba77dd77ed6d056b177d71d379e322773bd6af89ab2e4dd

SHA512
d0e068d18c23198620460ebcbba03ccb6a1f958336ae02469c5e0ca4f19cf3c760e1af9000b87e8dcbd61f7bab28164a8876121467ba6b372303e08619620b8c

Download Submit
memory/1116-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1116-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-16-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/2640-3-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2640-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2640-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-34-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-24-0x00000000004B0000-0x00000000004B8000-memory.dmp

Filesize
32KB

Download
memory/3900-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3900-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4152-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4152-22-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads