Analysis
-
max time kernel
116s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2024, 15:03
Behavioral task
behavioral1
Sample
2b94c39e7defb4dc1a65ab580fa543f5.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b94c39e7defb4dc1a65ab580fa543f5.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
2b94c39e7defb4dc1a65ab580fa543f5.exe
-
Size
7.8MB
-
MD5
2b94c39e7defb4dc1a65ab580fa543f5
-
SHA1
8a24f1588ba5e72febf72ac23ae9debedabe3693
-
SHA256
39f7477fcd8c960c14032809dcee2401c8705b2efa30b10085b02513b4f5ee0c
-
SHA512
e8e58e923c7ff1ec2fd7ef6df6c2f5b4eb787062ad2b430b21fc0529fc28ceee34b45b24466f4cc1b9b8e5b622d136e628396f174a02fd682712ad85bb572f4e
-
SSDEEP
196608:47effIPEsy58doQaTzwZ8Jq3QKnqVtxQLizl/sJEl2if8sHQoddmbKSyzybq3/TP:47effIPEsy58doQaTzwZ8Jq3QKnqVtxf
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 2b94c39e7defb4dc1a65ab580fa543f5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe," 2b94c39e7defb4dc1a65ab580fa543f5.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\spools.exe 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe 2b94c39e7defb4dc1a65ab580fa543f5.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" 2b94c39e7defb4dc1a65ab580fa543f5.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/memory/3332-13-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/files/0x000b000000023131-10.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe -
resource yara_rule behavioral2/memory/3332-0-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2884-1-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/files/0x000900000002312b-6.dat upx behavioral2/memory/3332-13-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/files/0x000b000000023131-10.dat upx behavioral2/memory/3332-14-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2884-16-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1660-17-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4168-18-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3332-19-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2884-22-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1660-24-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3332-26-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4168-30-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3332-31-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3332-41-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3332-46-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3332-61-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3332-66-0x0000000000400000-0x0000000000426000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 2b94c39e7defb4dc1a65ab580fa543f5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 2b94c39e7defb4dc1a65ab580fa543f5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 2b94c39e7defb4dc1a65ab580fa543f5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 2b94c39e7defb4dc1a65ab580fa543f5.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\T: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\V: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\X: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\H: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\E: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\J: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\K: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\S: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\N: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\U: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\N: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\E: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\Q: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\W: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\H: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\I: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\L: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\R: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\E: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\X: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\Q: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\R: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\H: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\T: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\E: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\O: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\G: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\I: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\K: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\T: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\U: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\W: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\W: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\P: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\L: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\O: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\V: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\M: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\N: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\G: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\J: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\M: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\N: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\P: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\V: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\O: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\I: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\Q: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\T: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\M: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\S: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\S: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\P: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\U: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\J: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\L: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\V: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\W: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\G: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\I: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\R: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\H: 2b94c39e7defb4dc1a65ab580fa543f5.exe File opened (read-only) \??\K: 2b94c39e7defb4dc1a65ab580fa543f5.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects reg.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe" 2b94c39e7defb4dc1a65ab580fa543f5.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftpdll.dll 2b94c39e7defb4dc1a65ab580fa543f5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 2884 2b94c39e7defb4dc1a65ab580fa543f5.exe 2884 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3332 wrote to memory of 2884 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 94 PID 3332 wrote to memory of 2884 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 94 PID 3332 wrote to memory of 2884 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 94 PID 3332 wrote to memory of 2720 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 95 PID 3332 wrote to memory of 2720 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 95 PID 3332 wrote to memory of 2720 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 95 PID 3332 wrote to memory of 1660 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 96 PID 3332 wrote to memory of 1660 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 96 PID 3332 wrote to memory of 1660 3332 2b94c39e7defb4dc1a65ab580fa543f5.exe 96 PID 2884 wrote to memory of 4168 2884 2b94c39e7defb4dc1a65ab580fa543f5.exe 98 PID 2884 wrote to memory of 4168 2884 2b94c39e7defb4dc1a65ab580fa543f5.exe 98 PID 2884 wrote to memory of 4168 2884 2b94c39e7defb4dc1a65ab580fa543f5.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b94c39e7defb4dc1a65ab580fa543f5.exe"C:\Users\Admin\AppData\Local\Temp\2b94c39e7defb4dc1a65ab580fa543f5.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\2b94c39e7defb4dc1a65ab580fa543f5.exeC:\Users\Admin\AppData\Local\Temp\2b94c39e7defb4dc1a65ab580fa543f5.exe2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2b94c39e7defb4dc1a65ab580fa543f5.exeC:\Users\Admin\AppData\Local\Temp\2b94c39e7defb4dc1a65ab580fa543f5.exe3⤵
- Enumerates connected drives
PID:4168
-
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\2b94c39e7defb4dc1a65ab580fa543f5.exeC:\Users\Admin\AppData\Local\Temp\2b94c39e7defb4dc1a65ab580fa543f5.exe2⤵
- Enumerates connected drives
PID:1660
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
375KB
MD574068aab92dd040d2729dda2f862147f
SHA1190887d6509f1399674a67a23434993fc38315ac
SHA25610d6e8f38f4562ccbdae7c3206b1fa906ec52261695bf300a800b946c20acede
SHA512094e8d82d145207fd29d8d952fe0e3ba9401652382a78dee18db14a0bbb148b537958a24106212f36791ef848e4670786d667b094f6b1e10e8225629052c216d
-
Filesize
5KB
MD5d807aa04480d1d149f7a4cac22984188
SHA1ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9
SHA256eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb
SHA512875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e