Analysis
- max time kernel
150s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe
- Size 1.9MB
- Sample240602-2a4mnshb8x
- SHA256 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4
- MD5 1502b9d6c65eaca9b3ee606de5e819db
- SHA1 f0f0e262fae8a79af5c132b8095cee633903037b
- SHA512 7cf86d9bd801b18f135e144991ef9500ff7b307a0310f57c544c7a0c9b85f4813612e354037cf8b8974d0eecd41f525667665fc396f20596f740caa8f7254925
- SSDEEP 49152:tUEicVlJL9NdVMt7tTfcqgDUr4KU8VyouHBWBLRkFmS4+mwc7KcJN2X:aEicVlJxlMvcqgYr4cVYQdkFEUX
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe - Executes dropped EXE 6 IoCs
pid Process 4868 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4384 icsys.icn.exe 2988 explorer.exe 3676 spoolsv.exe 4180 svchost.exe 3664 spoolsv.exe - Loads dropped DLL 1 IoCs
pid Process 4868 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023435-7.dat nsis_installer_1 behavioral2/files/0x0007000000023435-7.dat nsis_installer_2 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 4384 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2988 explorer.exe 4180 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 4384 icsys.icn.exe 4384 icsys.icn.exe 2988 explorer.exe 2988 explorer.exe 3676 spoolsv.exe 3676 spoolsv.exe 4180 svchost.exe 4180 svchost.exe 3664 spoolsv.exe 3664 spoolsv.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4628 wrote to memory of 4868 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 82 PID 4628 wrote to memory of 4868 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 82 PID 4628 wrote to memory of 4868 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 82 PID 4628 wrote to memory of 4384 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 83 PID 4628 wrote to memory of 4384 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 83 PID 4628 wrote to memory of 4384 4628 5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe 83 PID 4384 wrote to memory of 2988 4384 icsys.icn.exe 84 PID 4384 wrote to memory of 2988 4384 icsys.icn.exe 84 PID 4384 wrote to memory of 2988 4384 icsys.icn.exe 84 PID 2988 wrote to memory of 3676 2988 explorer.exe 85 PID 2988 wrote to memory of 3676 2988 explorer.exe 85 PID 2988 wrote to memory of 3676 2988 explorer.exe 85 PID 3676 wrote to memory of 4180 3676 spoolsv.exe 87 PID 3676 wrote to memory of 4180 3676 spoolsv.exe 87 PID 3676 wrote to memory of 4180 3676 spoolsv.exe 87 PID 4180 wrote to memory of 3664 4180 svchost.exe 88 PID 4180 wrote to memory of 3664 4180 svchost.exe 88 PID 4180 wrote to memory of 3664 4180 svchost.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe"C:\Users\Admin\AppData\Local\Temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\users\admin\appdata\local\temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exec:\users\admin\appdata\local\temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4868
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3664
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\5a08926d17908accd5e0dfd27ddcf0f8407848ea7fbb48e2d83c467800be89c4.exe
- Size 1.8MB
- SHA256 64e206e8cb344fea90fb1375b129befabaa120f9b1b24c41bf3e3e93159d85ec
- MD5 9ea60c10bc6a056a52b044bbeb56c7f4
- SHA1 2f1c01ce8da06d11e43f8885735ae28c649300e4
- SHA512 c2eb778c3998d38698ac8a6f3b993a06126f5c886c3f6a3e574957d58f0b4dabd740e2e7f0d54f477aaa97bd4ed4e744c6db7c499d08430fc18ad067fa903c7b
- SSDEEP 49152:CEicVlJL9NdVMt7tTfcqgDUr4KU8VyouHBWBLRkFmS4+mwc7KcJN2I:CEicVlJxlMvcqgYr4cVYQdkFEUI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsx417E.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- MD5 SHA1 SHA512
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 e558f6f03977cec189df5323e3fe8c11d6fc1255bf23d3f8917185101725517a
- MD5 3a6717780c645a0d46b115723af57e4d
- SHA1 c4e12420123446fab194e095ceb230fb2c1f543a
- SHA512 c3e1ba05ba2f0cd1ac65bdfc98868f9b745a50d58e250839c27580899750238828c3e19aa385409176a58dcd44db99625f10bfd13f29db9304284e3d9bf431ca
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVsHdY:UVqoCl/YgjxEufVU0TbTyDDaladY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 21caaf9f6eb42a256997c3e6807e600d4d524ed3f42789e41c0675d802aa155d
- MD5 c47938f07011edc0084bce186eef6d8a
- SHA1 70677b42e9ed9d095d67edf3a4681dae65c8431b
- SHA512 fd8447b0b91a3a6d5c3f4a14536786b20253bb2e5230479f5ce65b4c1d0ab7ca184bf8ec2cb07f701da67d26920971023295fdd1bf458de10f47c77c0e81de35
- SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDaladAeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeees:UsLqdufVUNDaveeeeeeeeeeeeeeeeee1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 35ea874a7be8a38fe4174ad12052635dc55d64cca4952f6c91a2b5bf2b12b4fa
- MD5 98cf4a7acf5d898c3f0b37a9640279c0
- SHA1 37bada5547aa9b12c1c67391e690733b0ec53e51
- SHA512 af88ab95c9863c16e07b0c2ede8d1dcf3e1822156bcf144690f09aa58169036bd3383e292471a3266acf9ad242cdc1f28c03047310264e47812af2a4daa2be60
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVsHdx:UVqoCl/YgjxEufVU0TbTyDDaladx
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\resources\svchost.exe
- Size 135KB
- SHA256 7923aa78c56d7a2fc1335c1bf6b6f91fcf36e4aa745c2b637b151274f90a8ba7
- MD5 346706ea969ac1864a5f511bba23544f
- SHA1 16414a9a36fb44ebc4d64ddaf4e4d06fde14f301
- SHA512 acfac687e01b37f3addef545c0fe567b429b6afb994e30bbd9ba834e425ca04ab58d9fc8856fae8f77e4bed5a4808e1885baaba407ab3311c25b76210b54f135
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVsHdj:UVqoCl/YgjxEufVU0TbTyDDaladj
- MD5 SHA1 SHA512 SSDEEP