Analysis
- max time kernel
24s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
24/12/2023, 15:48
Behavioral task
behavioral1
Sample
044e241db4488d2070180f14a5e18a5a.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
- Target 044e241db4488d2070180f14a5e18a5a.exe
- Size 298KB
- Sample231224-s83nlafcej
- SHA256 03e2bb2ee7a417a5dbe50592a1d3bb07de75bd9cbbd5cf5bd9b14679b61317a7
- MD5 044e241db4488d2070180f14a5e18a5a
- SHA1 c225d2ee58c2cb1ec91d9e33ca88823f1ee36eb8
- SHA512 2591c2c94f99372a220cea8a50b1ac58f2f49815b19f1cc7bf22ae763723c4158e6bb99a9aa429411f67f171546bb20305f5b7f9a48f5fb1ee4722d575b958e7
- SSDEEP 6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYj:v6Wq4aaE6KwyF5L0Y2D1PqLE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe - Executes dropped EXE 1 IoCs
pid Process 4784 svhost.exe -
resource yara_rule behavioral2/memory/1544-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x000d000000023151-3.dat upx behavioral2/files/0x00090000000231fa-103.dat upx behavioral2/memory/1544-763-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-1310-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-2368-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-3431-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-4490-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-5808-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-6871-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-7933-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-8990-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-10307-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-11373-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-12431-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-13487-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-14804-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4784-15867-0x0000000000400000-0x00000000004C2000-memory.dmp upx - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\y: svhost.exe - AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1544-763-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-1310-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-2368-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-3431-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-4490-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-5808-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-6871-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-7933-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-8990-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-10307-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-11373-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-12431-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-13487-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4784-14804-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 044e241db4488d2070180f14a5e18a5a.exe File opened for modification C:\Windows\Driver.db svhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1544 044e241db4488d2070180f14a5e18a5a.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4784 svhost.exe - Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 1544 044e241db4488d2070180f14a5e18a5a.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe - Suspicious use of SendNotifyMessage 45 IoCs
pid Process 1544 044e241db4488d2070180f14a5e18a5a.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 1544 044e241db4488d2070180f14a5e18a5a.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe 4784 svhost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1544 wrote to memory of 4784 1544 044e241db4488d2070180f14a5e18a5a.exe 88 PID 1544 wrote to memory of 4784 1544 044e241db4488d2070180f14a5e18a5a.exe 88 PID 1544 wrote to memory of 4784 1544 044e241db4488d2070180f14a5e18a5a.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\044e241db4488d2070180f14a5e18a5a.exe"C:\Users\Admin\AppData\Local\Temp\044e241db4488d2070180f14a5e18a5a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4784
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Driver.db
- Size 82B
- SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
- MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
- SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
- SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
- MD5 SHA1 SHA512
- Path C:\Windows\svhost.exe
- Size 298KB
- SHA256 056bee5ab65eb27f1ffcfecea64e9b8bd3652d9fcd1df993d53b7f84ed2df287
- MD5 5b0fca6bcdc04b2eb90acea2025dc197
- SHA1 e7b568e0016b4ef37ddfa044841fa354c1527f19
- SHA512 211d4750e293a1fe7085292723f2af6214df458e346987caf9183dbc16640bfe23c8a5722cb436a90305f8eb6c440d08d42f9b4d18bd71e481ac49f0b0c5723a
- SSDEEP 6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIY9:v6Wq4aaE6KwyF5L0Y2D1PqLO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\odt.exe
- Size 298KB
- SHA256 848dc6cfabf6c4becdedd902779c55faa7799c9158c8ad934e3329dfc942e460
- MD5 03fa887c777476c60289a9306a5c6102
- SHA1 d010febbf7a026d9588dd43643579207f49bfe5a
- SHA512 607b7c7e1b1bf212872cf93d02f2664a52f2b2390daee2ec73be469543cd27540269154a889ef7245f0af9f66f17bf0ae0a1a6f929657dab9bfd05818d5dbc65
- SSDEEP 6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYu:v6Wq4aaE6KwyF5L0Y2D1PqL/
- MD5 SHA1 SHA512 SSDEEP