Analysis
- max time kernel
150s - max time network
127s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
02/06/2024, 22:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe
- Size 1.9MB
- Sample240602-2a4mnshb8x
- SHA256 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4
- MD5 1502b9d6c65eaca9b3ee606de5e819db
- SHA1 f0f0e262fae8a79af5c132b8095cee633903037b
- SHA512 7cf86d9bd801b18f135e144991ef9500ff7b307a0310f57c544c7a0c9b85f4813612e354037cf8b8974d0eecd41f525667665fc396f20596f740caa8f7254925
- SSDEEP 49152:tUEicVlJL9NdVMt7tTfcqgDUr4KU8VyouHBWBLRkFmS4+mwc7KcJN2X:aEicVlJxlMvcqgYr4cVYQdkFEUX
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe - Executes dropped EXE 6 IoCs
pid Process 2596 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 892 icsys.icn.exe 2164 explorer.exe 2584 spoolsv.exe 1956 svchost.exe 1924 spoolsv.exe - Loads dropped DLL 7 IoCs
pid Process 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2596 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 892 icsys.icn.exe 2164 explorer.exe 2584 spoolsv.exe 1956 svchost.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0009000000014a94-6.dat nsis_installer_1 behavioral1/files/0x0009000000014a94-6.dat nsis_installer_2 - Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2216 schtasks.exe 1864 schtasks.exe 1012 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 892 icsys.icn.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2164 explorer.exe 1956 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 892 icsys.icn.exe 892 icsys.icn.exe 2164 explorer.exe 2164 explorer.exe 2584 spoolsv.exe 2584 spoolsv.exe 1956 svchost.exe 1956 svchost.exe 1924 spoolsv.exe 1924 spoolsv.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2596 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 28 PID 2744 wrote to memory of 2596 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 28 PID 2744 wrote to memory of 2596 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 28 PID 2744 wrote to memory of 2596 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 28 PID 2744 wrote to memory of 892 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 29 PID 2744 wrote to memory of 892 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 29 PID 2744 wrote to memory of 892 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 29 PID 2744 wrote to memory of 892 2744 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 29 PID 892 wrote to memory of 2164 892 icsys.icn.exe 30 PID 892 wrote to memory of 2164 892 icsys.icn.exe 30 PID 892 wrote to memory of 2164 892 icsys.icn.exe 30 PID 892 wrote to memory of 2164 892 icsys.icn.exe 30 PID 2164 wrote to memory of 2584 2164 explorer.exe 31 PID 2164 wrote to memory of 2584 2164 explorer.exe 31 PID 2164 wrote to memory of 2584 2164 explorer.exe 31 PID 2164 wrote to memory of 2584 2164 explorer.exe 31 PID 2584 wrote to memory of 1956 2584 spoolsv.exe 32 PID 2584 wrote to memory of 1956 2584 spoolsv.exe 32 PID 2584 wrote to memory of 1956 2584 spoolsv.exe 32 PID 2584 wrote to memory of 1956 2584 spoolsv.exe 32 PID 1956 wrote to memory of 1924 1956 svchost.exe 33 PID 1956 wrote to memory of 1924 1956 svchost.exe 33 PID 1956 wrote to memory of 1924 1956 svchost.exe 33 PID 1956 wrote to memory of 1924 1956 svchost.exe 33 PID 2164 wrote to memory of 2224 2164 explorer.exe 34 PID 2164 wrote to memory of 2224 2164 explorer.exe 34 PID 2164 wrote to memory of 2224 2164 explorer.exe 34 PID 2164 wrote to memory of 2224 2164 explorer.exe 34 PID 1956 wrote to memory of 2216 1956 svchost.exe 35 PID 1956 wrote to memory of 2216 1956 svchost.exe 35 PID 1956 wrote to memory of 2216 1956 svchost.exe 35 PID 1956 wrote to memory of 2216 1956 svchost.exe 35 PID 1956 wrote to memory of 1864 1956 svchost.exe 40 PID 1956 wrote to memory of 1864 1956 svchost.exe 40 PID 1956 wrote to memory of 1864 1956 svchost.exe 40 PID 1956 wrote to memory of 1864 1956 svchost.exe 40 PID 1956 wrote to memory of 1012 1956 svchost.exe 42 PID 1956 wrote to memory of 1012 1956 svchost.exe 42 PID 1956 wrote to memory of 1012 1956 svchost.exe 42 PID 1956 wrote to memory of 1012 1956 svchost.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe"C:\Users\Admin\AppData\Local\Temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\users\admin\appdata\local\temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exec:\users\admin\appdata\local\temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:25 /f6⤵
- Creates scheduled task(s)
PID:2216
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:26 /f6⤵
- Creates scheduled task(s)
PID:1864
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:27 /f6⤵
- Creates scheduled task(s)
PID:1012
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe4⤵PID:2224
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 11a34a4f0f35341831b29c768b72450fc5623059d8a27fafb922d9f6d1393703
- MD5 74c04b5005a94f4d93fb4d38b77d19ab
- SHA1 040ad6cd0cbe81c5b0d364a577e14e903da1b6e0
- SHA512 2bf0abd523adbb48069f9cb579a6d0c8ea5dfc57a5d7866083529255d0ec1b1a43703d95fea9f51a8fee5ffa8975a588466715110b76efb74544c1d2b0a35b32
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVsHdU:UVqoCl/YgjxEufVU0TbTyDDaladU
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe
- Size 1.8MB
- SHA256 64e206e8cb344fea90fb1375b129befabaa120f9b1b24c41bf3e3e93159d85ec
- MD5 9ea60c10bc6a056a52b044bbeb56c7f4
- SHA1 2f1c01ce8da06d11e43f8885735ae28c649300e4
- SHA512 c2eb778c3998d38698ac8a6f3b993a06126f5c886c3f6a3e574957d58f0b4dabd740e2e7f0d54f477aaa97bd4ed4e744c6db7c499d08430fc18ad067fa903c7b
- SSDEEP 49152:CEicVlJL9NdVMt7tTfcqgDUr4KU8VyouHBWBLRkFmS4+mwc7KcJN2I:CEicVlJxlMvcqgYr4cVYQdkFEUI
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nst8180.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- MD5 SHA1 SHA512
- Path \Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 21caaf9f6eb42a256997c3e6807e600d4d524ed3f42789e41c0675d802aa155d
- MD5 c47938f07011edc0084bce186eef6d8a
- SHA1 70677b42e9ed9d095d67edf3a4681dae65c8431b
- SHA512 fd8447b0b91a3a6d5c3f4a14536786b20253bb2e5230479f5ce65b4c1d0ab7ca184bf8ec2cb07f701da67d26920971023295fdd1bf458de10f47c77c0e81de35
- SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDaladAeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeees:UsLqdufVUNDaveeeeeeeeeeeeeeeeee1
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 0f985815e48c1850c89fa8b63a3b94c78d598bb97924ee7c252fafcbe8a66b81
- MD5 86ce9ac46e3b21f2c66f26b94d3aeeee
- SHA1 80d36d50d08c91183ccbfd3e3133f708368effa3
- SHA512 5a6e6d8fb7fc996425522c209f34cda427c7f069c54f5f443093f6de818b1237437bbd2f1777957ea9c334237f4cdea975eb3099699a8a56c49a4677e97f31fd
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVsHda:UVqoCl/YgjxEufVU0TbTyDDalada
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Resources\svchost.exe
- Size 135KB
- SHA256 5638e44b68959846cd0416abdc8da39c97a3d253da491cfe0d377d7317f6e5ef
- MD5 ef4b1d49d3edaa3734d6e1235451d476
- SHA1 eec62f7ae52138a38896e94bfd0383309b7b9046
- SHA512 8aef6f079adc005add35c3d8776af7e8c133913e57957763be7bff6e42a9015e07937c95443e1488403f8361a43dcbda3a6b7fdca16e11f71215776e95b45e35
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVsHdk:UVqoCl/YgjxEufVU0TbTyDDaladk
- MD5 SHA1 SHA512 SSDEEP