Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 15:11
Behavioral task
behavioral1
Sample
de4ed225b35cb8959cc93dfd4acbd089.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
de4ed225b35cb8959cc93dfd4acbd089.exe
-
Size
960KB
-
MD5
de4ed225b35cb8959cc93dfd4acbd089
-
SHA1
0f8e2b670af35cfec2a0ed7e36d115cac6bf8103
-
SHA256
4cb317572d9d8aa69fcae53148412f7858c19b2a6c33e5ed38d9feded693dde9
-
SHA512
35ae0b82b20c70f93eb4550f6272c0a57e43086677241ad7ebdc2be37bd32eecc7173d2cb1f21dfbcf6745396590702db3003aec5ae19766d4c09456c344a3ad
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0Yn:1thEVaPqLBthEVaPqLHthEVaPqLTthF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 1520 svhost.exe -
resource yara_rule behavioral2/memory/1988-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000400000001e5eb-3.dat upx behavioral2/memory/1520-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000c000000023127-104.dat upx behavioral2/memory/1988-719-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/1520-2617-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1988-719-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/1520-2617-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe de4ed225b35cb8959cc93dfd4acbd089.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1520 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe 1520 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1520 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 87 PID 1988 wrote to memory of 1520 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 87 PID 1988 wrote to memory of 1520 1988 de4ed225b35cb8959cc93dfd4acbd089.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\de4ed225b35cb8959cc93dfd4acbd089.exe"C:\Users\Admin\AppData\Local\Temp\de4ed225b35cb8959cc93dfd4acbd089.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD52e4b6e16a3c65f0ffaf0a09cd07e643f
SHA1d50317964b13b9c80c6d3967dcfb445c7fb61476
SHA25658a5daface4cd29456132cb7969ea54352ecdf8e2945429b371001cb6614b37b
SHA51237e1531591585cfa6298d88113673f0e35100c9d070ee1aee6179190cd42e057c53b905c00707049b82f2affbd7160c8dfc3df2728c9e451305c24012dd1e57f
-
Filesize
960KB
MD58e38f30f7b4860ecdac48c7e40fa669d
SHA1800ebbe45d08003544ab1bad986f32f5baa4f666
SHA256909241622d62925ca1d1568a16f2ca02c8b73d6c31c57dc38d2d735f3db863cf
SHA5121726c16f7345a8dcc6025103a1801b2dcf095fd20a25a8351cc399b2a03fae81ecf48d4bc3c22242a09bc70133aa0e99dd181eafa052d2709f172b7aa6d9a78f