Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/05/2024, 22:56
General
- Target 6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe
- Size 3.6MB
- Sample240525-2w46bsec44
- SHA256 6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs
- Drops file in Windows directory 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe"C:\Users\Admin\AppData\Local\Temp\6e156b26c265f81495405d28a1a0be5241e30aa2ed3af2b00ad34c5a39b8a45a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
explorer.exe
spoolsv.exe
svchost.exe
memory/936-2-0x0000000077463000-0x0000000077464000-memory.dmp
memory/936-1-0x0000000077462000-0x0000000077463000-memory.dmp
memory/936-0-0x0000000000400000-0x0000000000784000-memory.dmp
memory/936-47-0x0000000000400000-0x0000000000784000-memory.dmp
memory/2484-45-0x0000000000400000-0x0000000000784000-memory.dmp
memory/2484-24-0x0000000000400000-0x0000000000784000-memory.dmp
memory/3380-44-0x0000000000400000-0x0000000000784000-memory.dmp
memory/3380-38-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-33-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-49-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-68-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-70-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-72-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-74-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-66-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-58-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-64-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-62-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-52-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-76-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-54-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-60-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4472-56-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-53-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-57-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-55-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-61-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-51-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-63-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-50-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-65-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-48-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-12-0x0000000077462000-0x0000000077463000-memory.dmp
memory/4984-69-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-13-0x0000000077463000-0x0000000077464000-memory.dmp
memory/4984-71-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-14-0x0000000077463000-0x0000000077464000-memory.dmp
memory/4984-73-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-15-0x0000000077462000-0x0000000077463000-memory.dmp
memory/4984-75-0x0000000000400000-0x0000000000784000-memory.dmp
memory/4984-11-0x0000000000400000-0x0000000000784000-memory.dmp