Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 21:20
Behavioral task
behavioral1
Sample
044e241db4488d2070180f14a5e18a5a.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
044e241db4488d2070180f14a5e18a5a.exe
-
Size
298KB
-
MD5
044e241db4488d2070180f14a5e18a5a
-
SHA1
c225d2ee58c2cb1ec91d9e33ca88823f1ee36eb8
-
SHA256
03e2bb2ee7a417a5dbe50592a1d3bb07de75bd9cbbd5cf5bd9b14679b61317a7
-
SHA512
2591c2c94f99372a220cea8a50b1ac58f2f49815b19f1cc7bf22ae763723c4158e6bb99a9aa429411f67f171546bb20305f5b7f9a48f5fb1ee4722d575b958e7
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYj:v6Wq4aaE6KwyF5L0Y2D1PqLE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2144 svhost.exe -
resource yara_rule behavioral2/memory/4836-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x00080000000231f0-3.dat upx behavioral2/files/0x0008000000023203-103.dat upx behavioral2/memory/4836-764-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-1315-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-2373-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-2647-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-3440-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-4495-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-5814-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-6878-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-7936-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-9256-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-10313-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-11373-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-12431-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-13751-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-14811-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2144-15876-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\q: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4836-764-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-1315-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-2373-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-2647-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-3440-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-4495-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-5814-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-6878-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-7936-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-9256-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-10313-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-11373-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-12431-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-13751-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-14811-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2144-15876-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 044e241db4488d2070180f14a5e18a5a.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4836 044e241db4488d2070180f14a5e18a5a.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2144 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4836 044e241db4488d2070180f14a5e18a5a.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4836 044e241db4488d2070180f14a5e18a5a.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 4836 044e241db4488d2070180f14a5e18a5a.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe 2144 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4836 wrote to memory of 2144 4836 044e241db4488d2070180f14a5e18a5a.exe 87 PID 4836 wrote to memory of 2144 4836 044e241db4488d2070180f14a5e18a5a.exe 87 PID 4836 wrote to memory of 2144 4836 044e241db4488d2070180f14a5e18a5a.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\044e241db4488d2070180f14a5e18a5a.exe"C:\Users\Admin\AppData\Local\Temp\044e241db4488d2070180f14a5e18a5a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5131b806816f569838d8e4aebd2d4dead
SHA147c83a4dbc698a9294ac43fbe0c8a427e651ff43
SHA2568ed61b5265f4987047861994676b78c9a982a962d41b454621a67814e650206a
SHA512d5d5c5ebdedd1cbcd7e36066ad520e008e866b187cd1f17f9194d19c3bdedc840f377a792c5c650388401fa2e19a6ae05452121906e74d72e51ae7c05ee62d02
-
Filesize
298KB
MD5eaa256f29bba9e42123ee2627d31e8b7
SHA1aa04f658faba75e4e0752343a1daca3152ca67cb
SHA256a58b38b338029c5ea095fb2a55b25c8ad682072ef7c07d2aa9a7e88189d15f13
SHA512a90dacdf945bfd0899850db1ef12c6031de5accd4f10d4899750be5efc592b345bf8984cdaf31585d21db0b6d06f62442238170b1bf3c3e401757ca1c0fa0462