Analysis
-
max time kernel
165s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 12:39
Behavioral task
behavioral1
Sample
b4b6e7106620049e099e8ce6bcfa2e4b.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
b4b6e7106620049e099e8ce6bcfa2e4b.exe
-
Size
960KB
-
MD5
b4b6e7106620049e099e8ce6bcfa2e4b
-
SHA1
ef848872cfad218d234c3a2fa3acd2d12f12b2ac
-
SHA256
bf293d55d544dca86308292941e980db392b8ef7c8ba851bfe22ed41ef6faf23
-
SHA512
f8800d336e72c39d1ed4e48814c2f49a8f9a7b7d65dee898427a339d69bc6837de34225d00890b932ee23f22b3def4d9b5a9a888f7729d525556fc6a02d3cf1e
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0Yb:1thEVaPqLBthEVaPqLHthEVaPqLTthF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 1188 svhost.exe -
resource yara_rule behavioral2/memory/408-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x0007000000023201-3.dat upx behavioral2/memory/1188-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x0007000000023207-104.dat upx behavioral2/memory/408-126-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/1188-1694-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\s: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/408-126-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/1188-1694-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe b4b6e7106620049e099e8ce6bcfa2e4b.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1188 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 1188 svhost.exe 1188 svhost.exe 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 1188 svhost.exe 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 1188 svhost.exe 1188 svhost.exe 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 1188 svhost.exe 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe 1188 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 408 wrote to memory of 1188 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 90 PID 408 wrote to memory of 1188 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 90 PID 408 wrote to memory of 1188 408 b4b6e7106620049e099e8ce6bcfa2e4b.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4b6e7106620049e099e8ce6bcfa2e4b.exe"C:\Users\Admin\AppData\Local\Temp\b4b6e7106620049e099e8ce6bcfa2e4b.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD5b027ddb2c3aee031bbc1e442ae66dd1d
SHA1e8a149e0f9d7ac2382ac17264252a6edae17c4dd
SHA256ee64a80361c0382e9712cb5a70fff03a9584a2eedd9495dfededf255e892863d
SHA512e80853363c7da1de6c56b5f29d052f2091fe9c69bfde1c213742ea5cc9cfc02f671511c6996f54d6cf09372d61b4ded6aa658087f6b57fb5556b7a5491aed26b
-
Filesize
960KB
MD5e3cae8bf1b56a793a2e84f4a41940158
SHA13f2b26962c77843ef071197cdf004e003e4b352a
SHA256bc28052a6d6f796bfae67affa1ac78fe605f7822edb09fbda9e1759097403171
SHA512583fcad1dcd2d136f572bd6b0a9eafe6c2dc527769e71d8977c4f6ff49e5a8998e4d5b747ad22480aa92d9db939ced1719e8197ce5a63ccb446566d59ff93947