Analysis
-
max time kernel
152s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 05:14
Behavioral task
behavioral1
Sample
ca91e3450e28b08bf875908587f53dea.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
ca91e3450e28b08bf875908587f53dea.exe
-
Size
553KB
-
MD5
ca91e3450e28b08bf875908587f53dea
-
SHA1
aba170f3dd7ed20aa74e93aa5660c76d99f08658
-
SHA256
c2fe1ce891c43024f5759447b96f00b226c56ca816476b18549f8f1beb4dd88f
-
SHA512
927f919edaeb791f97a8be642ba0f67b2716149d2b3a6c08f6f9dde15e44a36258068f0bad5d3a4fdfd1ae6d6b020d1bbffe990317685fc05efa6eddff3c10b3
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1Pq4:1thEVaPqLBthEVaPq4
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 3040 svhost.exe -
resource yara_rule behavioral1/memory/2056-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x00040000000130fc-4.dat upx behavioral1/memory/3040-6-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x002f000000016576-66.dat upx behavioral1/memory/2056-560-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/3040-2610-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3040-6-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2056-560-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/3040-2610-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe ca91e3450e28b08bf875908587f53dea.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3040 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2056 ca91e3450e28b08bf875908587f53dea.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2056 ca91e3450e28b08bf875908587f53dea.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 2056 ca91e3450e28b08bf875908587f53dea.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe 3040 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 3040 2056 ca91e3450e28b08bf875908587f53dea.exe 28 PID 2056 wrote to memory of 3040 2056 ca91e3450e28b08bf875908587f53dea.exe 28 PID 2056 wrote to memory of 3040 2056 ca91e3450e28b08bf875908587f53dea.exe 28 PID 2056 wrote to memory of 3040 2056 ca91e3450e28b08bf875908587f53dea.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca91e3450e28b08bf875908587f53dea.exe"C:\Users\Admin\AppData\Local\Temp\ca91e3450e28b08bf875908587f53dea.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
553KB
MD53e859f1a174a84fa460b4e9b262803e0
SHA13942235253da86f64a7044a6abd55b2bd4dfdae5
SHA2569070a40cd40712825328a0e70685f8950b24107367ea237423f362241874f55b
SHA512e5f1206a349d526561d8d052a1eb6c3746213312f3fe2037478b3af8420dd76ed68460ce2c3bbc0ec864e0a986828eda4e3bb5c0194e25d27d10e82ab45689fb
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
553KB
MD5e73c97bc7b90ec4c8f87319f46143161
SHA16d726a38ad7313605a5cbe415af495bc6699d4db
SHA256ba6b28c2669699102fce861672517c8b4af2cab9c3f862c594f3a39221ba38ff
SHA512a08527f4b724d3babed4a2a755320c0c5ff190e78632933c353ba0ed756e85b5e5ecaf5f68a31e342c31079341192ee5268aeae13eabd846670bb99ed8613953