89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590

General

Target

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
Size

2.5MB
MD5

5480cdaf397ec7d51489a1ec48df429c
SHA1

039322ecdb08371144a76ca9e38f51aa0bfec024
SHA256

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590
SHA512

3854b8cbb812ce17c1510efa3ea5ff58322d932060dc8e5c1b863d0bdbe0882af53f42af46ccb443dab14ee031ffa86c401c7bc2e66904ef080b6771480f9b63
SSDEEP

49152:MxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxS:Mxx9NUFkQx753uWuCyyxS

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Detects executables packed with Themida 16 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2784-0-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
\Windows\Resources\Themes\explorer.exe	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2976-11-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
C:\Windows\Resources\spoolsv.exe	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2524-23-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
C:\Windows\Resources\svchost.exe	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2636-35-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2796-43-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2796-47-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2524-48-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2784-50-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2976-51-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2636-52-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2976-62-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2976-68-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2976-74-0x0000000000400000-0x0000000000A0E000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exeexplorer.exespoolsv.exespoolsv.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2976 explorer.exe
2524 spoolsv.exe
2636 svchost.exe
2796 spoolsv.exe
Loads dropped DLL 4 IoCs

Processes:

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exeexplorer.exespoolsv.exesvchost.exe

pid process

2784 89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2976 explorer.exe
2524 spoolsv.exe
2636 svchost.exe

pid	process
2976	explorer.exe
2524	spoolsv.exe
2636	svchost.exe
2796	spoolsv.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2784-0-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
\Windows\Resources\Themes\explorer.exe	themida
behavioral1/memory/2976-11-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
C:\Windows\Resources\spoolsv.exe	themida
behavioral1/memory/2524-23-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
C:\Windows\Resources\svchost.exe	themida
behavioral1/memory/2636-35-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2796-43-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2796-47-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2524-48-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2784-50-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2976-51-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2636-52-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2976-62-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2976-68-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2976-74-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2784 89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2976 explorer.exe
2524 spoolsv.exe
2636 svchost.exe
2796 spoolsv.exe

Drops file in Windows directory 4 IoCs

Processes:

explorer.exe89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2544 schtasks.exe
2328 schtasks.exe
1800 schtasks.exe

pid	process
2544	schtasks.exe
2328	schtasks.exe
1800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exeexplorer.exesvchost.exe

pid	process
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2976	explorer.exe
2976	explorer.exe
2636	svchost.exe
2636	svchost.exe
2976	explorer.exe
2976	explorer.exe
2636	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2976 explorer.exe
2636 svchost.exe

pid	process
2976	explorer.exe
2636	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
2976	explorer.exe
2976	explorer.exe
2524	spoolsv.exe
2524	spoolsv.exe
2636	svchost.exe
2636	svchost.exe
2796	spoolsv.exe
2796	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2784 wrote to memory of 2976	2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe	explorer.exe
PID 2784 wrote to memory of 2976	2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe	explorer.exe
PID 2784 wrote to memory of 2976	2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe	explorer.exe
PID 2784 wrote to memory of 2976	2784	89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe	explorer.exe
PID 2976 wrote to memory of 2524	2976	explorer.exe	spoolsv.exe
PID 2976 wrote to memory of 2524	2976	explorer.exe	spoolsv.exe
PID 2976 wrote to memory of 2524	2976	explorer.exe	spoolsv.exe
PID 2976 wrote to memory of 2524	2976	explorer.exe	spoolsv.exe
PID 2524 wrote to memory of 2636	2524	spoolsv.exe	svchost.exe
PID 2524 wrote to memory of 2636	2524	spoolsv.exe	svchost.exe
PID 2524 wrote to memory of 2636	2524	spoolsv.exe	svchost.exe
PID 2524 wrote to memory of 2636	2524	spoolsv.exe	svchost.exe
PID 2636 wrote to memory of 2796	2636	svchost.exe	spoolsv.exe
PID 2636 wrote to memory of 2796	2636	svchost.exe	spoolsv.exe
PID 2636 wrote to memory of 2796	2636	svchost.exe	spoolsv.exe
PID 2636 wrote to memory of 2796	2636	svchost.exe	spoolsv.exe
PID 2976 wrote to memory of 2188	2976	explorer.exe	Explorer.exe
PID 2976 wrote to memory of 2188	2976	explorer.exe	Explorer.exe
PID 2976 wrote to memory of 2188	2976	explorer.exe	Explorer.exe
PID 2976 wrote to memory of 2188	2976	explorer.exe	Explorer.exe
PID 2636 wrote to memory of 2544	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 2544	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 2544	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 2544	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 2328	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 2328	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 2328	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 2328	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 1800	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 1800	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 1800	2636	svchost.exe	schtasks.exe
PID 2636 wrote to memory of 1800	2636	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe
"C:\Users\Admin\AppData\Local\Temp\89a2cf3f42ccf919d224c04120d83a14769ae50f59a2e181f766a104a98b1590.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2976
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2636
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:2796
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:41 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2544
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:42 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2328
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:43 /f
        5⤵
        Creates scheduled task(s)
        
        PID:1800
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
2.5MB

MD5
98c937621695e2135ed5ae69368e5e57

SHA1
9df70e06a1a76aa1483d4f86274d7d50d29ccbbe

SHA256
0d351cd7b0fe7945781b03770a53c40f72a982714bc806c0b6018b169e7fb98e

SHA512
5d435bf29c8ef81463a2fa25afd26efe569ec436302900c2b4ab22118922f5883f8f774cd0f7e17431252fcc8f5393329c53f1ebd4e42cd96638b0b4620d7ec3

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
2.5MB

MD5
480d929e895fac20a0471910da8b4a83

SHA1
17d34c09f9fd28534d89fe9b6d4a0a552bd115ab

SHA256
b040d324decd2f5bf1dcd3c30b87d3bee95ab7ae88190071de2484a57ce50df3

SHA512
14d8614261ce505551c055cafa8ab6367edfa436bf6837647baa3e19a7db2138fa6e7149ac144ac586409440410116c758041f05d790486406063e7331f2a11f

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
2.5MB

MD5
cd1ae195a1a81341e3197c09e510105f

SHA1
fab3614635534d26ee445408f41692a3950364d5

SHA256
b34637d706407653787c52f34c23f2dba79aa659cf96aede6c2d7c971c0baa44

SHA512
6f00771a13b396c86c79adef77069d8eb255412d0744d6e9715f1950617e6db76f3680305d87c7a57c9c2ea9b434ea6bebde7afd39a8c5d6c697bd6dcbeb6e16

Download Submit
memory/2524-23-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2524-48-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2524-34-0x0000000003680000-0x0000000003C8E000-memory.dmp

Filesize
6.1MB

Download
memory/2636-52-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2636-35-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2636-42-0x00000000031B0000-0x00000000037BE000-memory.dmp

Filesize
6.1MB

Download
memory/2784-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2784-50-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2784-1-0x0000000077350000-0x0000000077352000-memory.dmp

Filesize
8KB

Download
memory/2796-43-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2796-47-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2976-22-0x00000000037A0000-0x0000000003DAE000-memory.dmp

Filesize
6.1MB

Download
memory/2976-51-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2976-11-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2976-53-0x00000000037A0000-0x0000000003DAE000-memory.dmp

Filesize
6.1MB

Download
memory/2976-62-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2976-68-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2976-74-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads