Analysis
-
max time kernel
119s -
max time network
110s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 11:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
120 seconds
General
-
Target
f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe
-
Size
360KB
-
MD5
f1ba1f1d8bb249cb706207ec450d32b0
-
SHA1
2b63c27e18ec8ec3644a0282a00de8db457864e6
-
SHA256
f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585d
-
SHA512
05702f8c67a818a358cbd52597e0a4e98a511e23cde3074c5ed9b470e02eb50dc6321558088df0b559e422237cc8e64847e10840f8db797c513ec1919c3d8c6f
-
SSDEEP
6144:QuQZl3OEseqn+2cYW/xH4/pARwV9j3X2czASWecASuZu:0ZtnseI+tJY/pAaV9TX2ccvbA
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6A5B00014973000BEA52B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6A5B00014973000BEA52B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6A5B00014973000BEA52B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6A5B00014973000BEA52B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6A5B00014973000BEA52B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 2788 043A6A5B00014973000BEA52B4EB2331.exe -
Executes dropped EXE 1 IoCs
pid Process 2788 043A6A5B00014973000BEA52B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6A5B00014973000BEA52B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 043A6A5B00014973000BEA52B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6A5B00014973000BEA52B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 043A6A5B00014973000BEA52B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6A5B00014973000BEA52B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6A5B00014973000BEA52B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6A5B00014973000BEA52B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6A5B00014973000BEA52B4EB2331 = "C:\\ProgramData\\043A6A5B00014973000BEA52B4EB2331\\043A6A5B00014973000BEA52B4EB2331.exe" 043A6A5B00014973000BEA52B4EB2331.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 043A6A5B00014973000BEA52B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2788 043A6A5B00014973000BEA52B4EB2331.exe 2788 043A6A5B00014973000BEA52B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2788 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 31 PID 2668 wrote to memory of 2788 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 31 PID 2668 wrote to memory of 2788 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 31 PID 2668 wrote to memory of 2788 2668 f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe"C:\Users\Admin\AppData\Local\Temp\f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\ProgramData\043A6A5B00014973000BEA52B4EB2331\043A6A5B00014973000BEA52B4EB2331.exe"C:\ProgramData\043A6A5B00014973000BEA52B4EB2331\043A6A5B00014973000BEA52B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585dN.exe"2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD5f1ba1f1d8bb249cb706207ec450d32b0
SHA12b63c27e18ec8ec3644a0282a00de8db457864e6
SHA256f02be53a77152cccf7588c70cf96b56d138723bce10d27de60db5d199a94585d
SHA51205702f8c67a818a358cbd52597e0a4e98a511e23cde3074c5ed9b470e02eb50dc6321558088df0b559e422237cc8e64847e10840f8db797c513ec1919c3d8c6f