Analysis
- max time kernel
152s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
12/04/2024, 18:58
Behavioral task
behavioral1
Sample
148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe
Resource
win7-20231129-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe
- Size 2.5MB
- Sample240412-xms99adb22
- SHA256 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc
- MD5 7129024da28ccee803057e1ce63cb711
- SHA1 296962dcc62caf166e54d0984e4d399e01645ae2
- SHA512 99d8e843b0560a53ae617ebf571526fa32e8ab2cea4b97198f82e08bb5e3309bab84f9a37da130ececcac0f86252e556fddcb6a76856e95a4015cd2851ddf40e
- SSDEEP 49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxL:hxx9NUFkQx753uWuCyyxL
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Detects executables packed with Themida 17 IoCs
resource yara_rule behavioral2/memory/3236-0-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/files/0x0009000000023528-8.dat INDICATOR_EXE_Packed_Themida behavioral2/memory/716-10-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/files/0x000800000002352d-15.dat INDICATOR_EXE_Packed_Themida behavioral2/memory/2676-19-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/files/0x0009000000023535-26.dat INDICATOR_EXE_Packed_Themida behavioral2/memory/2476-28-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3236-34-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3920-37-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2676-38-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3236-39-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/716-40-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2476-41-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/716-42-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/716-44-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/716-52-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/716-62-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe - Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe - Executes dropped EXE 4 IoCs
pid Process 716 explorer.exe 2676 spoolsv.exe 2476 svchost.exe 3920 spoolsv.exe -
resource yara_rule behavioral2/memory/3236-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/files/0x0009000000023528-8.dat themida behavioral2/memory/716-10-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/files/0x000800000002352d-15.dat themida behavioral2/memory/2676-19-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/files/0x0009000000023535-26.dat themida behavioral2/memory/2476-28-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3236-34-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3920-37-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2676-38-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3236-39-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/716-40-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2476-41-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/716-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/716-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/716-52-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/716-62-0x0000000000400000-0x0000000000A0E000-memory.dmp themida - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 716 explorer.exe 2676 spoolsv.exe 2476 svchost.exe 3920 spoolsv.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe 716 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 716 explorer.exe 2476 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 716 explorer.exe 716 explorer.exe 2676 spoolsv.exe 2676 spoolsv.exe 2476 svchost.exe 2476 svchost.exe 3920 spoolsv.exe 3920 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3236 wrote to memory of 716 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 96 PID 3236 wrote to memory of 716 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 96 PID 3236 wrote to memory of 716 3236 148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe 96 PID 716 wrote to memory of 2676 716 explorer.exe 97 PID 716 wrote to memory of 2676 716 explorer.exe 97 PID 716 wrote to memory of 2676 716 explorer.exe 97 PID 2676 wrote to memory of 2476 2676 spoolsv.exe 99 PID 2676 wrote to memory of 2476 2676 spoolsv.exe 99 PID 2676 wrote to memory of 2476 2676 spoolsv.exe 99 PID 2476 wrote to memory of 3920 2476 svchost.exe 100 PID 2476 wrote to memory of 3920 2476 svchost.exe 100 PID 2476 wrote to memory of 3920 2476 svchost.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe"C:\Users\Admin\AppData\Local\Temp\148705bd22edae7c8cd1ed96ddd298cf49222a6f4057d0cf2e9bc100755db9bc.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3920
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3240,i,11689630796550498308,215737424132741214,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:81⤵PID:3880
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 2.5MB
- SHA256 f93424aa8e1e90fabcea591ba23b576c2187c443765e59937cff85813305496e
- MD5 c7ac5ac409033e7c82fa83baea5954c3
- SHA1 7995d35fb113390cf4159742c49e9fb3d1b4d26e
- SHA512 c3b7528bea742de277e68543ed411846245fd5f754bea6d48d6d1d04f43e0aacb34248a94d2f738eb56968512ba844a709870189153c576fe5b3852740c3d0a0
- SSDEEP 49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx8:hxx9NUFkQx753uWuCyyx8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 2.5MB
- SHA256 8b0a33f75c25469394d76ea4c0e2abf368ee9486dce0e56aeb171ebbda780804
- MD5 1ee7b0ef2b7caa37c15663f1fc3a1002
- SHA1 cb28409673469bedfb51305de0581587ddebe765
- SHA512 a4400814ceb3c4f2c805a68f14f2d461309c089f34cc5b315088726e9135862bd49d88ff19b614ca09733f6a56944a6937db9a87ec2bedd050e677f8c89a56a5
- SSDEEP 49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxQ:hxx9NUFkQx753uWuCyyxQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 2.5MB
- SHA256 e933b81960766dd2efe5fbb45e88ecdac32373d1947ef55d56c420dac8cd82d0
- MD5 74297902d5c91600b900a25c211e4997
- SHA1 02c7252c2c6fb45a196091fee2d3f5fa4b5b592c
- SHA512 7a3ab013bb85e84d052063d9af22d92018ca6c8e082ca9bfb7db6d12362bc0c5c54ade107bea45e98f577ae2bfa0d668d92011e0aee478469f0e35320b046f58
- SSDEEP 49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxT:hxx9NUFkQx753uWuCyyxT
- MD5 SHA1 SHA512 SSDEEP