6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
Size 3.6MB
Sample240525-2w46bsec44
SHA256 6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a
MD5 52d149f49e5c00a7ffc5d63186b367cc
SHA1 4232aa590ae0dab80ea9a8a5d0caf30f51a6248e
SHA512 2e38901afa81af5ca3363d039815f37eac7e919bb2407694ecfc1f7f01e364c6267ea22e5552843cec3432cf76c8092352b0816eb1e2b1d6d2e8a6b4dd1a503a
SSDEEP 98304:UdByXcdnlLwOrI5Vfeg91hZOhkRpsinjv:Udien+OrFuBR6cv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2480	explorer.exe
2540	spoolsv.exe
2660	svchost.exe
2516	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
2480	explorer.exe
2540	spoolsv.exe
2660	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs

pid	Process
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
2480	explorer.exe
2480	explorer.exe
2540	spoolsv.exe
2660	svchost.exe
2660	svchost.exe
2516	spoolsv.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2416	schtasks.exe
1636	schtasks.exe
1036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2660	svchost.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe
2480	explorer.exe
2660	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2480	explorer.exe
2660	svchost.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2540	spoolsv.exe
2540	spoolsv.exe
2540	spoolsv.exe
2660	svchost.exe
2660	svchost.exe
2660	svchost.exe
2516	spoolsv.exe
2516	spoolsv.exe
2516	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2480	1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe	28
PID 1684 wrote to memory of 2480	1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe	28
PID 1684 wrote to memory of 2480	1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe	28
PID 1684 wrote to memory of 2480	1684	6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe	28
PID 2480 wrote to memory of 2540	2480	explorer.exe	29
PID 2480 wrote to memory of 2540	2480	explorer.exe	29
PID 2480 wrote to memory of 2540	2480	explorer.exe	29
PID 2480 wrote to memory of 2540	2480	explorer.exe	29
PID 2540 wrote to memory of 2660	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2660	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2660	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2660	2540	spoolsv.exe	30
PID 2660 wrote to memory of 2516	2660	svchost.exe	31
PID 2660 wrote to memory of 2516	2660	svchost.exe	31
PID 2660 wrote to memory of 2516	2660	svchost.exe	31
PID 2660 wrote to memory of 2516	2660	svchost.exe	31
PID 2480 wrote to memory of 2996	2480	explorer.exe	32
PID 2480 wrote to memory of 2996	2480	explorer.exe	32
PID 2480 wrote to memory of 2996	2480	explorer.exe	32
PID 2480 wrote to memory of 2996	2480	explorer.exe	32
PID 2660 wrote to memory of 2416	2660	svchost.exe	33
PID 2660 wrote to memory of 2416	2660	svchost.exe	33
PID 2660 wrote to memory of 2416	2660	svchost.exe	33
PID 2660 wrote to memory of 2416	2660	svchost.exe	33
PID 2660 wrote to memory of 1636	2660	svchost.exe	38
PID 2660 wrote to memory of 1636	2660	svchost.exe	38
PID 2660 wrote to memory of 1636	2660	svchost.exe	38
PID 2660 wrote to memory of 1636	2660	svchost.exe	38
PID 2660 wrote to memory of 1036	2660	svchost.exe	40
PID 2660 wrote to memory of 1036	2660	svchost.exe	40
PID 2660 wrote to memory of 1036	2660	svchost.exe	40
PID 2660 wrote to memory of 1036	2660	svchost.exe	40

C:\Users\Admin\AppData\Local\Temp\6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
"C:\Users\Admin\AppData\Local\Temp\6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2480
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2660
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:2516
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:58 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2416
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:59 /f
        5⤵
        Creates scheduled task(s)
        
        PID:1636
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 23:00 /f
        5⤵
        Creates scheduled task(s)
        
        PID:1036
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 3.6MB
SHA256 10151f832986cb2b1697a14d7c85e84d404d71ed6b8c70b4e3bf6c8212e8ce5b
MD5 be6c5714f42f90dcd26c499504ab4b85
SHA1 0ea6ac5ced45698a436ee47fef7f89d8e6766ee9
SHA512 b32748f8689a229d8b6bd206f44936684434ebf230f1f0820e9640ba66ce9038078f127a2a0a0852f741dc0dadc5686c5f07c7cdca5bd7a0286d5f2164109dd4
SSDEEP 98304:UdByXcdnlLwOrI5Vfeg91hZOhkRpsinjb:Udien+OrFuBR6cb
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \Windows\Resources\Themes\explorer.exe
Size 3.6MB
SHA256 580f3575df2181c31b1502819252a1c2a29c2510288c3b39bb6ebefd90470386
MD5 b46ba2c338e2887d66aa0a3b9c7bd154
SHA1 2f1228ceb0941cda4d62510a25790440bc68d481
SHA512 6b7fd150923ec2089a6b07cf24db04bab17196d2d15cb8b0fe622336e7d277d14bb5898d518e315d90bd8cd9e639fccbade200915770c33ddaadfa87c3dfca8b
SSDEEP 98304:UdByXcdnlLwOrI5Vfeg91hZOhkRpsinjP:Udien+OrFuBR6cP
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Windows\Resources\svchost.exe
Size 3.6MB
SHA256 fd5340bbc5b6b0272be9cc4fc317b3671febab38badac1e699360aba18b9a29b
MD5 d92d696386cb41456c1c743e3dee918f
SHA1 d991a5450451797f63129a58b096b7945e795369
SHA512 f2c3126100bd1ba6eb370b441628b05ec1dfeeb23f2e9d54f5fc64b5e51459ff583b62a09b90a842164faedce13dcfc7268d4101d5e4d1174938555b627708c5
SSDEEP 98304:UdByXcdnlLwOrI5Vfeg91hZOhkRpsinjX:Udien+OrFuBR6cX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1684-1-0x0000000077D90000-0x0000000077D91000-memory.dmp

Download

memory/1684-11-0x00000000038A0000-0x0000000003C24000-memory.dmp

Download

memory/1684-0-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/1684-50-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-57-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-59-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-79-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-67-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-63-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-61-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-52-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-77-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-54-0x0000000003A80000-0x0000000003E04000-memory.dmp

Download

memory/2480-75-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-73-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-65-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-71-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-81-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2480-69-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2516-46-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2540-23-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2540-32-0x0000000003A00000-0x0000000003D84000-memory.dmp

Download

memory/2540-48-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-62-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-66-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-64-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-68-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-60-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-70-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-58-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-72-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-56-0x0000000003A00000-0x0000000003D84000-memory.dmp

Download

memory/2660-74-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-55-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-76-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-53-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-78-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-41-0x0000000003A00000-0x0000000003D84000-memory.dmp

Download

memory/2660-80-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-35-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/2660-82-0x0000000000400000-0x0000000000784000-memory.dmp

Download