Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 12:39
Behavioral task
behavioral1
Sample
b4b6e7106620049e099e8ce6bcfa2e4b.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
b4b6e7106620049e099e8ce6bcfa2e4b.exe
-
Size
960KB
-
MD5
b4b6e7106620049e099e8ce6bcfa2e4b
-
SHA1
ef848872cfad218d234c3a2fa3acd2d12f12b2ac
-
SHA256
bf293d55d544dca86308292941e980db392b8ef7c8ba851bfe22ed41ef6faf23
-
SHA512
f8800d336e72c39d1ed4e48814c2f49a8f9a7b7d65dee898427a339d69bc6837de34225d00890b932ee23f22b3def4d9b5a9a888f7729d525556fc6a02d3cf1e
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0Yb:1thEVaPqLBthEVaPqLHthEVaPqLTthF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2696 svhost.exe -
resource yara_rule behavioral1/memory/2492-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x0009000000012247-6.dat upx behavioral1/memory/2696-7-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/2492-5-0x0000000003340000-0x0000000003463000-memory.dmp upx behavioral1/files/0x0009000000014a94-67.dat upx behavioral1/memory/2492-708-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/2696-2585-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\w: svhost.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2696-7-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2492-708-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2696-2585-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe b4b6e7106620049e099e8ce6bcfa2e4b.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2696 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe 2696 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2696 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 28 PID 2492 wrote to memory of 2696 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 28 PID 2492 wrote to memory of 2696 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 28 PID 2492 wrote to memory of 2696 2492 b4b6e7106620049e099e8ce6bcfa2e4b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4b6e7106620049e099e8ce6bcfa2e4b.exe"C:\Users\Admin\AppData\Local\Temp\b4b6e7106620049e099e8ce6bcfa2e4b.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD50dc87ed4f2e529266cdbffc1e3e896cc
SHA19dcfb65bab2faf6ef487c1653b0b00c25c202bf1
SHA256bd395418cf2f733fa5028b327995b2951d5475b570d5158cba47bc4c9a4ca24e
SHA512dad4380cff9cd72d200f3a750e648aebe3cc839fcc78f792d6126390469158b8799d4bfe5f9fb83995c32e33816bf5aa6ad410465b6f5d4fa96d2e6bc724734a
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD55e44c1084bdcc79065526c598e287b28
SHA13dcd4f098ae78807e0a1cd8acc45d7c1f6ace748
SHA2560120c24d45508382320f43c6c79ae0f81d12df1e5cb1a428fb4e1b3615a86e07
SHA512296190ee955e21a695801f3b7849a667c321d51f0fa0f9345ee9a552fecc1bde931e2d8927b6d5442e39eb3ef20470e4e1c119731ada3fdf8889d3e5c4802bcb