Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 05:16
Behavioral task
behavioral1
Sample
0fcb352c0774261bf11d109698e80cdc.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
0fcb352c0774261bf11d109698e80cdc.exe
-
Size
298KB
-
MD5
0fcb352c0774261bf11d109698e80cdc
-
SHA1
6d5d61e0d3aa52153f1e4ad1d274abc1f57283ad
-
SHA256
02e86a0308e4e37ded6bfc19461caffb6efe10a573e6921552d039d396090444
-
SHA512
26d75dce444fbc29c7dfb59b81cb863232e2b5ae9d18181c1d75a81ddbb31c8aa5c52d0b242eecc1588ab2ecc6bac28d6df48f3a35ba22a7a32353350eb9cb84
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYv:v6Wq4aaE6KwyF5L0Y2D1PqLC
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2320 svhost.exe -
resource yara_rule behavioral1/memory/2000-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x00090000000120e1-4.dat upx behavioral1/memory/2320-6-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x000f00000001552e-67.dat upx behavioral1/memory/2000-708-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-1305-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-2363-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-2630-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-3423-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-4487-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-5809-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-6868-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-7934-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-9256-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-10318-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-11382-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-12449-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-13519-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-14840-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2320-15908-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\v: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2000-708-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-1305-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-2363-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-2630-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-3423-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-4487-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-5809-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-6868-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-7934-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-9256-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-10318-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-11382-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-12449-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-13519-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-14840-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2320-15908-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 0fcb352c0774261bf11d109698e80cdc.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2320 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2000 0fcb352c0774261bf11d109698e80cdc.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2000 0fcb352c0774261bf11d109698e80cdc.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2000 0fcb352c0774261bf11d109698e80cdc.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe 2320 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2320 2000 0fcb352c0774261bf11d109698e80cdc.exe 28 PID 2000 wrote to memory of 2320 2000 0fcb352c0774261bf11d109698e80cdc.exe 28 PID 2000 wrote to memory of 2320 2000 0fcb352c0774261bf11d109698e80cdc.exe 28 PID 2000 wrote to memory of 2320 2000 0fcb352c0774261bf11d109698e80cdc.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fcb352c0774261bf11d109698e80cdc.exe"C:\Users\Admin\AppData\Local\Temp\0fcb352c0774261bf11d109698e80cdc.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5a58cc272dd6d864540e606b02dc25661
SHA1ef77cc2bffe8757a09bca58f47ab063e3c56cccf
SHA256ac69982f8622052ff01ad997f7d867f0df0dae1b78abd4cf3bd9d7f9024871ec
SHA512357469a5bf9b2cd56b4085fbe2473c5b02ec129a46b1a517d06a5d0f639234a171d4729b2b78a48237a9ec369971887074ab1e6fd337dcfa637ac93bdb309130
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5fbef32638e3efe3a6e3e68722403401c
SHA14abc853b4eabf1c37373dabe7fce17a9542f8a32
SHA2567f255554d6b31874e3bc2698601734c05d1d209b6dfac0b9e27a909be0b20c09
SHA512acd693e65313749d765fbae719416ba278aecc143bc092e7767fb34eff6822e1e78db333d36fd3eaa05364d6795361d0870a155ea993dab83f9455ae0e1e8661