Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-04-2024 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe
-
Size
135KB
-
MD5
8e54bcbc6d7c3c11ce5a058463f02a6f
-
SHA1
867552607510068f384c9d6986947fa63c3c9768
-
SHA256
c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200
-
SHA512
b072a96e130a26f0663eedca29b42fa169607a54a4241193562f9a58a21a6ae5352624172e25fc4e2e21cfdda32b9c14b1332b019be60018ced6ba066285e986
-
SSDEEP
1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgtx:XVqoCl/YgjxEufVU0TbTyDDalqx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 2524 explorer.exe 2632 spoolsv.exe 2908 svchost.exe 2752 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2524 explorer.exe 2632 spoolsv.exe 2908 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2432 schtasks.exe 1548 schtasks.exe 680 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2908 svchost.exe 2908 svchost.exe 2524 explorer.exe 2908 svchost.exe 2524 explorer.exe 2908 svchost.exe 2524 explorer.exe 2908 svchost.exe 2524 explorer.exe 2908 svchost.exe 2524 explorer.exe 2908 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2524 explorer.exe 2908 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 2524 explorer.exe 2524 explorer.exe 2632 spoolsv.exe 2632 spoolsv.exe 2908 svchost.exe 2908 svchost.exe 2752 spoolsv.exe 2752 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2524 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 28 PID 2744 wrote to memory of 2524 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 28 PID 2744 wrote to memory of 2524 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 28 PID 2744 wrote to memory of 2524 2744 c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe 28 PID 2524 wrote to memory of 2632 2524 explorer.exe 29 PID 2524 wrote to memory of 2632 2524 explorer.exe 29 PID 2524 wrote to memory of 2632 2524 explorer.exe 29 PID 2524 wrote to memory of 2632 2524 explorer.exe 29 PID 2632 wrote to memory of 2908 2632 spoolsv.exe 30 PID 2632 wrote to memory of 2908 2632 spoolsv.exe 30 PID 2632 wrote to memory of 2908 2632 spoolsv.exe 30 PID 2632 wrote to memory of 2908 2632 spoolsv.exe 30 PID 2908 wrote to memory of 2752 2908 svchost.exe 31 PID 2908 wrote to memory of 2752 2908 svchost.exe 31 PID 2908 wrote to memory of 2752 2908 svchost.exe 31 PID 2908 wrote to memory of 2752 2908 svchost.exe 31 PID 2524 wrote to memory of 2568 2524 explorer.exe 32 PID 2524 wrote to memory of 2568 2524 explorer.exe 32 PID 2524 wrote to memory of 2568 2524 explorer.exe 32 PID 2524 wrote to memory of 2568 2524 explorer.exe 32 PID 2908 wrote to memory of 2432 2908 svchost.exe 33 PID 2908 wrote to memory of 2432 2908 svchost.exe 33 PID 2908 wrote to memory of 2432 2908 svchost.exe 33 PID 2908 wrote to memory of 2432 2908 svchost.exe 33 PID 2908 wrote to memory of 1548 2908 svchost.exe 38 PID 2908 wrote to memory of 1548 2908 svchost.exe 38 PID 2908 wrote to memory of 1548 2908 svchost.exe 38 PID 2908 wrote to memory of 1548 2908 svchost.exe 38 PID 2908 wrote to memory of 680 2908 svchost.exe 40 PID 2908 wrote to memory of 680 2908 svchost.exe 40 PID 2908 wrote to memory of 680 2908 svchost.exe 40 PID 2908 wrote to memory of 680 2908 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe"C:\Users\Admin\AppData\Local\Temp\c35fc58abaaf7b5eedb55dbeb8e495960878d89c26b68c8f4f7cbca4690d4200.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2752
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:57 /f5⤵
- Creates scheduled task(s)
PID:2432
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:58 /f5⤵
- Creates scheduled task(s)
PID:1548
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:59 /f5⤵
- Creates scheduled task(s)
PID:680
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2568
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5fd30c6ab459ebcba4b37a53cbb191150
SHA1761770364e2304a3b8152ad60dd50a5fe51044bf
SHA256b0d552724223be1e13f7f98753839fbe3eedb618dc3ece427ab857a585ac410c
SHA5120b01e0744128786cce3eb12d685409fda879bba6f8217f6bf90a58a93e2214fcd5fedb5dda1233218771dc6a4a428ae5689a81bb2ac273638ac9486b81262369
-
Filesize
135KB
MD55d087857b58056d1749c47cb63a899a8
SHA14325b430d73afc1b692799af379e8cb56b4a8613
SHA256abd5d904830ea62f8d578f43be08e7c5731a27b1c694814121a86f912e30cb33
SHA5124e4b62ffa18e7ca69f03feaa3eb0d387f51c27329903cf1fb5edd1c62800c341e513af69e2391030237e6dbc1bccd5bdf1acfff0df91dafd926e1855977b97cd
-
Filesize
135KB
MD5a94de630031c9e3a345057d7eb69977b
SHA1044a375e641e5660313a2f3083751472a95820c6
SHA2564c00def3a86a7451823d8d4a0ef5500a3aa010746e7b7d8032927e092254c353
SHA512ae84a72c85866cb210fb520ccf10717d5b4e7a41fa70b7f40f656aa63ff5c267db820242aaf81ecf16bd37bdd1019274900cf438ec40ff723fd26a0151e3f299