Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 04:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe
-
Size
130KB
-
MD5
b11471389c9db15db9c49af31480ee00
-
SHA1
ce40b2f6c51ee9906a6490aa760e1c8c91d52843
-
SHA256
a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a
-
SHA512
3736b82ea602946c6eb6651a59f6dfbda7941e957ec5362930a20fe51cab2514b125b36e05c489fc8c3d8abdac5ab11396f17c4735aa1b2f859b5ebea9e75753
-
SSDEEP
1536:OfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdj:OVqoCl/YgjxEufVU0TbTyDDalbj
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 1996 explorer.exe 1788 spoolsv.exe 2648 svchost.exe 2728 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1996 explorer.exe 1996 explorer.exe 1788 spoolsv.exe 1788 spoolsv.exe 2648 svchost.exe 2648 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 268 schtasks.exe 2732 schtasks.exe 2768 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 2648 svchost.exe 2648 svchost.exe 1996 explorer.exe 2648 svchost.exe 1996 explorer.exe 2648 svchost.exe 1996 explorer.exe 2648 svchost.exe 1996 explorer.exe 2648 svchost.exe 1996 explorer.exe 2648 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1996 explorer.exe 2648 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 1996 explorer.exe 1996 explorer.exe 1788 spoolsv.exe 1788 spoolsv.exe 2648 svchost.exe 2648 svchost.exe 2728 spoolsv.exe 2728 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1420 wrote to memory of 1996 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 28 PID 1420 wrote to memory of 1996 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 28 PID 1420 wrote to memory of 1996 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 28 PID 1420 wrote to memory of 1996 1420 a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe 28 PID 1996 wrote to memory of 1788 1996 explorer.exe 29 PID 1996 wrote to memory of 1788 1996 explorer.exe 29 PID 1996 wrote to memory of 1788 1996 explorer.exe 29 PID 1996 wrote to memory of 1788 1996 explorer.exe 29 PID 1788 wrote to memory of 2648 1788 spoolsv.exe 30 PID 1788 wrote to memory of 2648 1788 spoolsv.exe 30 PID 1788 wrote to memory of 2648 1788 spoolsv.exe 30 PID 1788 wrote to memory of 2648 1788 spoolsv.exe 30 PID 2648 wrote to memory of 2728 2648 svchost.exe 31 PID 2648 wrote to memory of 2728 2648 svchost.exe 31 PID 2648 wrote to memory of 2728 2648 svchost.exe 31 PID 2648 wrote to memory of 2728 2648 svchost.exe 31 PID 1996 wrote to memory of 2568 1996 explorer.exe 32 PID 1996 wrote to memory of 2568 1996 explorer.exe 32 PID 1996 wrote to memory of 2568 1996 explorer.exe 32 PID 1996 wrote to memory of 2568 1996 explorer.exe 32 PID 2648 wrote to memory of 2732 2648 svchost.exe 33 PID 2648 wrote to memory of 2732 2648 svchost.exe 33 PID 2648 wrote to memory of 2732 2648 svchost.exe 33 PID 2648 wrote to memory of 2732 2648 svchost.exe 33 PID 2648 wrote to memory of 2768 2648 svchost.exe 38 PID 2648 wrote to memory of 2768 2648 svchost.exe 38 PID 2648 wrote to memory of 2768 2648 svchost.exe 38 PID 2648 wrote to memory of 2768 2648 svchost.exe 38 PID 2648 wrote to memory of 268 2648 svchost.exe 40 PID 2648 wrote to memory of 268 2648 svchost.exe 40 PID 2648 wrote to memory of 268 2648 svchost.exe 40 PID 2648 wrote to memory of 268 2648 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe"C:\Users\Admin\AppData\Local\Temp\a706215d07d8eebd77c396bb53a2d6afcc2717eb9bfdd9f8c354b6d46157689a.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:02 /f5⤵
- Creates scheduled task(s)
PID:2732
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:03 /f5⤵
- Creates scheduled task(s)
PID:2768
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:04 /f5⤵
- Creates scheduled task(s)
PID:268
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2568
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD5c744a455561cf3d2f135f47f118a9764
SHA1cd30f37a55157eb442529e38d439c1000677a10c
SHA256578a352922c67a8f690df1b4c55f50fe3451dee2d368737c498dabee4142240a
SHA5126a1860ad6383e998e5ae5819bce1cdc39fc662fbe424cbb7c6ac5e9edd624e8aadc253144a2f9c3c98b0b79c1d04e848bde9a4d08f47acfbb4eaa9b4b0ce229a
-
Filesize
130KB
MD533bca437cb4f24c02a3461c2ee2d4a90
SHA191e72133419ca14e27f1247dbc8d3fc49ba9a396
SHA256dd5259304589165a9c2388e67a1b6ecd7f4b00af0ee126f546611e3577a9deff
SHA51292c065b7ae07e7b85948a03fd4a9b05f4b5382b5f11045cadc64a93acf5230de30758b92e5c5eb7f022ae5eca06dcc35d1a2eec00b2028cb315e79b0e665d21a
-
Filesize
130KB
MD561117efd508aeb179b941bf0acecd373
SHA15592246a9450d2c7c8b45d859bf5843738ccade9
SHA2565fa797aff6e264e3ec06e64ff1025afe3598d5878d86c5170b0b38ce2ceaa297
SHA512a3eac80a2224c57cd7c26efda10cb0ff40f1899f3e439899e81e2f59f698b6c0a23f89bd0160dc9a139133ea606664395219b451687133ebe1ccf5b4b39cbb5c