Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 21:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29ea677be271b426ff00f623a60ac1ce.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
29ea677be271b426ff00f623a60ac1ce.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
29ea677be271b426ff00f623a60ac1ce.exe
-
Size
233KB
-
MD5
29ea677be271b426ff00f623a60ac1ce
-
SHA1
936a5e611aa8df60aa481ca53a12032f788874c4
-
SHA256
aaa4ae317836c95f46a460028d849496276c2d06c9713f55db9e1826264946fd
-
SHA512
ad224d998394155aeb7c5bd76a7abd00b0f762b1c316ed3e0a4379c9b3bbf848d390af370353e0aac6266fcff369924bb551765db62b5f42cf59fa57b5e4046a
-
SSDEEP
3072:5VqoCl/YgjxEufVU0TbTyDDaluz/dAMhdF2jBCmLdjaf3k6aaICeHO:5sLqdufVUNDacz/LLvmpjE3EaICeu
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 616 explorer.exe 2524 spoolsv.exe 2676 svchost.exe 2540 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 616 explorer.exe 616 explorer.exe 2524 spoolsv.exe 2524 spoolsv.exe 2676 svchost.exe 2676 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 29ea677be271b426ff00f623a60ac1ce.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2460 schtasks.exe 108 schtasks.exe 1032 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 2676 svchost.exe 2676 svchost.exe 616 explorer.exe 2676 svchost.exe 616 explorer.exe 2676 svchost.exe 616 explorer.exe 2676 svchost.exe 616 explorer.exe 2676 svchost.exe 616 explorer.exe 2676 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 616 explorer.exe 2676 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1640 29ea677be271b426ff00f623a60ac1ce.exe 1640 29ea677be271b426ff00f623a60ac1ce.exe 616 explorer.exe 616 explorer.exe 2524 spoolsv.exe 2524 spoolsv.exe 2676 svchost.exe 2676 svchost.exe 2540 spoolsv.exe 2540 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1640 wrote to memory of 616 1640 29ea677be271b426ff00f623a60ac1ce.exe 28 PID 1640 wrote to memory of 616 1640 29ea677be271b426ff00f623a60ac1ce.exe 28 PID 1640 wrote to memory of 616 1640 29ea677be271b426ff00f623a60ac1ce.exe 28 PID 1640 wrote to memory of 616 1640 29ea677be271b426ff00f623a60ac1ce.exe 28 PID 616 wrote to memory of 2524 616 explorer.exe 29 PID 616 wrote to memory of 2524 616 explorer.exe 29 PID 616 wrote to memory of 2524 616 explorer.exe 29 PID 616 wrote to memory of 2524 616 explorer.exe 29 PID 2524 wrote to memory of 2676 2524 spoolsv.exe 30 PID 2524 wrote to memory of 2676 2524 spoolsv.exe 30 PID 2524 wrote to memory of 2676 2524 spoolsv.exe 30 PID 2524 wrote to memory of 2676 2524 spoolsv.exe 30 PID 2676 wrote to memory of 2540 2676 svchost.exe 31 PID 2676 wrote to memory of 2540 2676 svchost.exe 31 PID 2676 wrote to memory of 2540 2676 svchost.exe 31 PID 2676 wrote to memory of 2540 2676 svchost.exe 31 PID 616 wrote to memory of 2704 616 explorer.exe 32 PID 616 wrote to memory of 2704 616 explorer.exe 32 PID 616 wrote to memory of 2704 616 explorer.exe 32 PID 616 wrote to memory of 2704 616 explorer.exe 32 PID 2676 wrote to memory of 2460 2676 svchost.exe 33 PID 2676 wrote to memory of 2460 2676 svchost.exe 33 PID 2676 wrote to memory of 2460 2676 svchost.exe 33 PID 2676 wrote to memory of 2460 2676 svchost.exe 33 PID 2676 wrote to memory of 108 2676 svchost.exe 38 PID 2676 wrote to memory of 108 2676 svchost.exe 38 PID 2676 wrote to memory of 108 2676 svchost.exe 38 PID 2676 wrote to memory of 108 2676 svchost.exe 38 PID 2676 wrote to memory of 1032 2676 svchost.exe 40 PID 2676 wrote to memory of 1032 2676 svchost.exe 40 PID 2676 wrote to memory of 1032 2676 svchost.exe 40 PID 2676 wrote to memory of 1032 2676 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\29ea677be271b426ff00f623a60ac1ce.exe"C:\Users\Admin\AppData\Local\Temp\29ea677be271b426ff00f623a60ac1ce.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2540
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:57 /f5⤵
- Creates scheduled task(s)
PID:2460
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:58 /f5⤵
- Creates scheduled task(s)
PID:108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:59 /f5⤵
- Creates scheduled task(s)
PID:1032
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2704
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
233KB
MD52acf8dd4e3a33e09b9334391ba71604b
SHA17a0df989af86797d97036d4f91a498045989a575
SHA2564fb588cab5e07adc3cc50bac0f196e8df8fe068095c59d8ca3d99f15ab9a78a6
SHA5128ffef01463b69cdd2ced12f6970f853872631cdad91e88d659d337e30245cb38ad13016eb700ac4db25a4895c5b8b839284aa71b67de871f0653160614be9de0
-
Filesize
233KB
MD50f0d2a11adc69995cee4d64f562e323d
SHA179fdc56144b851f1cfb654ccc277b0ea6f509121
SHA2563593fdffca7fbb544aa7c27da7dc5c0a4cd3907747d3bc83b651c52cc2f574eb
SHA512ce95b4a08a3bd328e5a8b732176442380e8f324d1bdc72c3363d29091d5aa65263c1f30321b4c24869b7117bf63b87d03ec0635deb636aef179b3bb89f81f5b9
-
Filesize
233KB
MD56dfc5dcd6f338a2082d94e5fe8edc039
SHA1ca202cc1c6c3812d9e79669c97dd94984523cf4a
SHA2560edd20f43662b644f7f917bca96340ae4e656d35c4adba721c7dfc7ec6f5db00
SHA5121d86dd9cad94186a81c452a29683830165571d2e03db1bf4c6198e62bded9cfa43864a016a818e4267ad60526227572a77583b84b9b014bfee81072d0c608cb6