246a0fec1e0c201fd407a74231a70ce7f5345ab376029db4e79bea4ba27acd46

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2.exe
Size

1.9MB
MD5

211d67cb160ae80cd5b8f51e768ecf03
SHA1

7bc311419bbd63b5d9f11e31676b23916dd92a73
SHA256

d9a91d7519b16a30328c22ad2be0b6c31a0c169fd8333567c389f66057d95902
SHA512

42e800ab0285507d1329df885de52398511ae8a73e8b90eac0590eddccebd5335375e6e409e1541459ebf2bd9751bf8f1327790fc7a764f2ac2c5957212b4cbb
SSDEEP

24576:PFOatRpLVFPbthieraHDowhhk70Trcfdq+rw24kM1p2yvCVlnU9zJkGIAYhbljgK:txRpL/bC/9jkQTAfdWVLCVyKn2K1

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
4560	2.exe
1544	icsys.icn.exe
336	explorer.exe
1120	spoolsv.exe
4836	svchost.exe
1824	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4396	2.exe
4560	2.exe
4560	2.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
1544	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
336	explorer.exe
4836	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4396	2.exe
4396	2.exe
1544	icsys.icn.exe
1544	icsys.icn.exe
336	explorer.exe
336	explorer.exe
1120	spoolsv.exe
1120	spoolsv.exe
4836	svchost.exe
4836	svchost.exe
1824	spoolsv.exe
1824	spoolsv.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4560	4396	2.exe	83
PID 4396 wrote to memory of 4560	4396	2.exe	83
PID 4396 wrote to memory of 4560	4396	2.exe	83
PID 4396 wrote to memory of 1544	4396	2.exe	84
PID 4396 wrote to memory of 1544	4396	2.exe	84
PID 4396 wrote to memory of 1544	4396	2.exe	84
PID 1544 wrote to memory of 336	1544	icsys.icn.exe	85
PID 1544 wrote to memory of 336	1544	icsys.icn.exe	85
PID 1544 wrote to memory of 336	1544	icsys.icn.exe	85
PID 336 wrote to memory of 1120	336	explorer.exe	86
PID 336 wrote to memory of 1120	336	explorer.exe	86
PID 336 wrote to memory of 1120	336	explorer.exe	86
PID 1120 wrote to memory of 4836	1120	spoolsv.exe	87
PID 1120 wrote to memory of 4836	1120	spoolsv.exe	87
PID 1120 wrote to memory of 4836	1120	spoolsv.exe	87
PID 4836 wrote to memory of 1824	4836	svchost.exe	88
PID 4836 wrote to memory of 1824	4836	svchost.exe	88
PID 4836 wrote to memory of 1824	4836	svchost.exe	88

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396
- \??\c:\users\admin\appdata\local\temp\2.exe
  c:\users\admin\appdata\local\temp\2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1544
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:336
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1120
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4836
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2.exe

Filesize
1.8MB

MD5
f434acf8284d1018f7f5f669e0ff3811

SHA1
33e6d6e152ade16f89f7d16cebe5fff0aac14906

SHA256
dcb30771b6b0be73068b3ad774336e25c84ad8e5a8691da5525265f9159bf654

SHA512
60cd1f56f89426d244dd610ca52605092466c0f5b8b47cf58a3b1378dc931b9125b4f23c4ceb6cd2206b2d868dab3e1a19f9dfe4c88d30c7432fe8fca721073a

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
3aba47eee05eef6b32745b6705ad3789

SHA1
4ff2c4c6e8c8d3688f8a2f1bae76fb7d24817f42

SHA256
5af86259f5e085be97a12557eed18ef05fed54ba5beebeefb57ae83e87abc8df

SHA512
98d530011c417385f44ab84812d6082baa15515e97c700efc41e6e1f42978cc0eef89e552f7b3a0f495ac6663917985a12a2e80380a396798943d82ba3301749

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
40d722b56fe299558fdc4822923440bd

SHA1
3a898e04f2c46db5a64541897aa0dcb1dc4ca126

SHA256
e6965494331849d9cd156fe0e7f9655115207a0460f5eff6f12515ed03983ffa

SHA512
c157c9cca7d605313f6d29c91660418d77515eb4147ff5bfb218af4767bf93d8883af54608c318251f1e40e6d0fb868c2d6971df482e862022572dcb6aad0cbd

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
54d58c10764c9f4bfa4b44357dc3c02e

SHA1
92911502b37e1f5713250a6ad03808730b8f3ab1

SHA256
3946fb0b144d0b5e57da9f9a0834f5bc1ab41c9d696b30a1e9b88cea64c873af

SHA512
b18c5ab82976dcc4558ac244fceb04d9788c9083c1c8e3dc876953b30e5fc0ad7514485fb60ab087305b5abde85752524f61b064b0349e62db197ff2e5b52bfa

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
4bb93c93b3f731a6a37b4dd68f47b459

SHA1
6536bf26cd614ff3e377cf3037954c34bca45ff0

SHA256
3f7816df032fb17d796c9a28348425b1d73c5acda3fec5e1f79ba50eb0ac90bf

SHA512
7da6feb78ef7fc49de0a0fd7e8ac051e074f56a5f40a39a245733f1bbda158be7445107dc4420baadc2e908bc84a9cd9e8221b9665b9dbde2db39d5e5d58b315

Download Submit
memory/336-21-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1120-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1544-49-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1824-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4396-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4396-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4560-10-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/4560-9-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download