Analysis
-
max time kernel
158s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:56
Behavioral task
behavioral1
Sample
12bee5a0f409509a09d5042769cea45e.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
12bee5a0f409509a09d5042769cea45e.exe
-
Size
960KB
-
MD5
12bee5a0f409509a09d5042769cea45e
-
SHA1
d49b0e3551f5602389294170768344a07ca7771b
-
SHA256
e3b3f42cc2a24dd62ee89245d50dd815c87b033b45f402ec36e751b3b7b3288b
-
SHA512
016391a9bb084857f770b23d088796e2cd08e27e52b162e0e7f7b479f0ecaa20ef72980848824d1ac6f6341a75c1628c8f2ac68fccb29d6b5f6d6aca09cbcfe1
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0YJ:1thEVaPqLBthEVaPqLHthEVaPqLTthX
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2296 svhost.exe -
resource yara_rule behavioral1/memory/2232-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x0008000000012270-4.dat upx behavioral1/files/0x0007000000016cf1-65.dat upx behavioral1/memory/2232-498-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/2296-2616-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\l: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2232-498-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2296-2616-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 12bee5a0f409509a09d5042769cea45e.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2296 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2232 12bee5a0f409509a09d5042769cea45e.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2232 12bee5a0f409509a09d5042769cea45e.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2232 12bee5a0f409509a09d5042769cea45e.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe 2296 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2296 2232 12bee5a0f409509a09d5042769cea45e.exe 28 PID 2232 wrote to memory of 2296 2232 12bee5a0f409509a09d5042769cea45e.exe 28 PID 2232 wrote to memory of 2296 2232 12bee5a0f409509a09d5042769cea45e.exe 28 PID 2232 wrote to memory of 2296 2232 12bee5a0f409509a09d5042769cea45e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\12bee5a0f409509a09d5042769cea45e.exe"C:\Users\Admin\AppData\Local\Temp\12bee5a0f409509a09d5042769cea45e.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD50c4db98b60b5cadc4103afc07797f549
SHA180f75f7b040b2c4b4f09efa5f492f40c5d7a336f
SHA256759df47e90da28bea6545236403d5a7da5a2aee207088ae4dc46df0ca75f25b0
SHA512b9b96b06ddc57dad573650c14d69f3030c1770c071d2ae0ca751145c966e517f3c6e71a65ef01540e95d46eb332c3fe42353eaa793c966fb166bc70512928ca7
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD530405ec00e729d80e566264102a99960
SHA11a04fd4a5bbac0bea1f94066e96f5c8d538073cf
SHA2565c3993d9215d63752ff0c39a1c84f6a3cc1bd31a11a83ec3cb639abfc0c16a58
SHA512968fd1b06ae5118b81fc1bf9f2c170b457d84b9d81b614ac132a4388fdef764f7d9ef0899b489d1313eea9f47c518ad49c26cd2a84b50e165af7e0e9f3fb16b1