Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 22:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe
-
Size
135KB
-
MD5
dca2f57a7d98846603c844bcefcb3d98
-
SHA1
f83ec0cf3589b7dd0bbb058f8f98cad4bb9e048f
-
SHA256
5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea
-
SHA512
4953b855e8059bcaf457f7b3bddff989026e16945178cd21d59eca9211c19e4a8da7d3f0c8b01b0bc47b17025410ec5ec40fd31e0cf5509735f6870f6b28c208
-
SSDEEP
3072:UVqoCl/YgjxEufVU0TbTyDDalHhLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL1:UsLqdufVUNDa5
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 2300 explorer.exe 2304 spoolsv.exe 2752 svchost.exe 2656 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 2300 explorer.exe 2304 spoolsv.exe 2752 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2852 schtasks.exe 1672 schtasks.exe 2452 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2300 explorer.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2300 explorer.exe 2752 svchost.exe 2752 svchost.exe 2300 explorer.exe 2300 explorer.exe 2752 svchost.exe 2300 explorer.exe 2752 svchost.exe 2300 explorer.exe 2752 svchost.exe 2300 explorer.exe 2752 svchost.exe 2300 explorer.exe 2752 svchost.exe 2300 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2752 svchost.exe 2300 explorer.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 2300 explorer.exe 2300 explorer.exe 2304 spoolsv.exe 2304 spoolsv.exe 2752 svchost.exe 2752 svchost.exe 2656 spoolsv.exe 2656 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2300 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 28 PID 1744 wrote to memory of 2300 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 28 PID 1744 wrote to memory of 2300 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 28 PID 1744 wrote to memory of 2300 1744 5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe 28 PID 2300 wrote to memory of 2304 2300 explorer.exe 29 PID 2300 wrote to memory of 2304 2300 explorer.exe 29 PID 2300 wrote to memory of 2304 2300 explorer.exe 29 PID 2300 wrote to memory of 2304 2300 explorer.exe 29 PID 2304 wrote to memory of 2752 2304 spoolsv.exe 30 PID 2304 wrote to memory of 2752 2304 spoolsv.exe 30 PID 2304 wrote to memory of 2752 2304 spoolsv.exe 30 PID 2304 wrote to memory of 2752 2304 spoolsv.exe 30 PID 2752 wrote to memory of 2656 2752 svchost.exe 31 PID 2752 wrote to memory of 2656 2752 svchost.exe 31 PID 2752 wrote to memory of 2656 2752 svchost.exe 31 PID 2752 wrote to memory of 2656 2752 svchost.exe 31 PID 2300 wrote to memory of 2472 2300 explorer.exe 32 PID 2300 wrote to memory of 2472 2300 explorer.exe 32 PID 2300 wrote to memory of 2472 2300 explorer.exe 32 PID 2300 wrote to memory of 2472 2300 explorer.exe 32 PID 2752 wrote to memory of 2852 2752 svchost.exe 33 PID 2752 wrote to memory of 2852 2752 svchost.exe 33 PID 2752 wrote to memory of 2852 2752 svchost.exe 33 PID 2752 wrote to memory of 2852 2752 svchost.exe 33 PID 2752 wrote to memory of 1672 2752 svchost.exe 38 PID 2752 wrote to memory of 1672 2752 svchost.exe 38 PID 2752 wrote to memory of 1672 2752 svchost.exe 38 PID 2752 wrote to memory of 1672 2752 svchost.exe 38 PID 2752 wrote to memory of 2452 2752 svchost.exe 40 PID 2752 wrote to memory of 2452 2752 svchost.exe 40 PID 2752 wrote to memory of 2452 2752 svchost.exe 40 PID 2752 wrote to memory of 2452 2752 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe"C:\Users\Admin\AppData\Local\Temp\5c929e729ab93633487e8a61d73e996cd14c38c9ae8ad59be41e84e77b6093ea.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:10 /f5⤵
- Creates scheduled task(s)
PID:2852
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:11 /f5⤵
- Creates scheduled task(s)
PID:1672
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:12 /f5⤵
- Creates scheduled task(s)
PID:2452
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2472
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD505029d25cdd06090ecbb567135ac9ee6
SHA124a86660c0f807d554e37a4113ba5ed23a5387ee
SHA2569e68bca6448c98eddb01fe6e28be019f0f6cb16c238cf851303af36137b366cf
SHA5125adfceea9be19e376d1ba063d5220f0b2d3b2df1add9b55997c054f9e8fb7ba4a3693f8307e4dac5d79b2cb31650f6ba245a0b2b911e11f3929210ee70e67cdf
-
Filesize
135KB
MD5516af8bf4d8bfc2731250f63dc09a1a5
SHA12e38ee91a0ef13f71de472fe6e39593755a65a8c
SHA2564f6056119c22ac1e12d70ab670ea5c890afe8eeb3fc76bf53344fff2f52ad154
SHA512e7eaf161c958e519c9878677efddab4afb60fb3e76f710eedf64393119139a40d113d0a52f3409f9bb352e0488aa45924183a00f0bc96142e7be0691e11d7196
-
Filesize
135KB
MD5d8659a3bf1775de231ef563126d99771
SHA10bb17ee7653441d9ac542f8da793aacd0a196f68
SHA2561cfa26e4bc34ed86f1c5ad76eabfd8a0c0e3453ed6b072bba6122bb7a723acd0
SHA5129085cf763c28b1b523a748af9c5039d06ca9ca10193a0b7a9806f649442c2df5630fc46a708c0c218952e0251cab44b2fa798fc6e3d866be15eb99e49a6f27b1