Overview

overview

10

Static

static

3

231f51c17f...80.exe

windows7-x64

10

231f51c17f...80.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 20:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    231f51c17fd1b6cca60b3aadc7ea49d7b7ce3d3732811a6cd174ab8d51a11c80.exe

  • Size

    135KB

  • MD5

    8c03873f5e0683f238194cdc3d3dbb31

  • SHA1

    945f97c066e2f75bbeda1cf065b0f6f10a6f7f4e

  • SHA256

    231f51c17fd1b6cca60b3aadc7ea49d7b7ce3d3732811a6cd174ab8d51a11c80

  • SHA512

    29214cb2a7280593653cf92dcac1d54ee671174ee828d742b90440534bc859029e1e79859ef0b5d050a9d697598c93c20bb12e0efa75521baa8f161c8b15d9b2

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVT+0tr:UVqoCl/YgjxEufVU0TbTyDDal0Sr

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\231f51c17fd1b6cca60b3aadc7ea49d7b7ce3d3732811a6cd174ab8d51a11c80.exe
    "C:\Users\Admin\AppData\Local\Temp\231f51c17fd1b6cca60b3aadc7ea49d7b7ce3d3732811a6cd174ab8d51a11c80.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:736
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3524
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4032
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:684
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2120

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\Resources\Themes\explorer.exe
          Filesize

          135KB

          MD5

          2b833e5cdfce3d9dbb24f09a07a4214d

          SHA1

          bc8c97bf932e3f376a98862bd07d137a9b0fbadd

          SHA256

          f03e69142ff74de36fd97ff8203c928bacb4f18cfbf8e2b8bb3ff6fbdd91d69b

          SHA512

          827056363c9768b669cb888929fc9d5e6ee5812cc85d6b50fa3c1c608271e0d3f9a3ef273687de7d33d1507962bf8fde40ad4c7c1601519c5564ebc054ae819d

          Download Submit

        • C:\Windows\Resources\spoolsv.exe
          Filesize

          135KB

          MD5

          d6d3cca5e552d784c0179f1c158712cf

          SHA1

          4f253a936cf7f1bc01b0b2bd95215bb665f14e46

          SHA256

          206c331bd8d6159ebb218afb369080da7dfa5021d10c7378f18a268eb462a42f

          SHA512

          e8a119897f183304719d96056e7179394b253536ed6453fab89b4023b4bfede602b600b3a85fcf390c42c1e386ae31bbd7347b4fdcf0973b8e74a1df69af218c

          Download Submit

        • C:\Windows\Resources\svchost.exe
          Filesize

          135KB

          MD5

          f3895c3d3972aa03ac70f57db9b4667e

          SHA1

          15a80b107b40bc2a3de10cf8ff26735864f3f34c

          SHA256

          9604615720abc7663f7752ba37378b40ff10a0f74a7bf3b594d045593d42ec09

          SHA512

          76ed3949615b6349cf4c21bd21cccdafc74eafb14d669e14acbc3774177ff1fa7392e967c3396291f97e1e36203021410a9c4fc8bcfe81d730845658f41652aa

          Download Submit

        • memory/736-0-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/736-35-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2120-33-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/3524-9-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/4032-34-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download