Analysis
- max time kernel
150s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe
Resource
win7-20240220-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe
- Size 126KB
- Sample240602-2jth3aaf84
- SHA256 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce
- MD5 4944cc56bb8d6085f3bc2fc59e46c6dc
- SHA1 8c80726f892376335b955102d8298a3b0927f5fd
- SHA512 9fac43a78fae43189d6f1f388416893884a49bd7b590a6b466863572334d63f5c30cafafc357bf3333f9cc58b13b827c309d03717be9f3f94f6916e32b3fb6e2
- SSDEEP 1536:PoXJ1oTKUbX/sw/LLRJjVY8Vxg5WDvOAAIZcIvvsswHFsqO:PoLoeqEeLLDBxAWSgcIvu6P
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 3268 explorer.exe 3692 spoolsv.exe 2892 svchost.exe 1360 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1624 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe 1624 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe 3268 explorer.exe 3268 explorer.exe 3268 explorer.exe 3268 explorer.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe 3268 explorer.exe 3268 explorer.exe 2892 svchost.exe 2892 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3268 explorer.exe 2892 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1624 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe 1624 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe 3268 explorer.exe 3268 explorer.exe 3692 spoolsv.exe 3692 spoolsv.exe 2892 svchost.exe 2892 svchost.exe 1360 spoolsv.exe 1360 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1624 wrote to memory of 3268 1624 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe 83 PID 1624 wrote to memory of 3268 1624 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe 83 PID 1624 wrote to memory of 3268 1624 5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe 83 PID 3268 wrote to memory of 3692 3268 explorer.exe 84 PID 3268 wrote to memory of 3692 3268 explorer.exe 84 PID 3268 wrote to memory of 3692 3268 explorer.exe 84 PID 3692 wrote to memory of 2892 3692 spoolsv.exe 85 PID 3692 wrote to memory of 2892 3692 spoolsv.exe 85 PID 3692 wrote to memory of 2892 3692 spoolsv.exe 85 PID 2892 wrote to memory of 1360 2892 svchost.exe 86 PID 2892 wrote to memory of 1360 2892 svchost.exe 86 PID 2892 wrote to memory of 1360 2892 svchost.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe"C:\Users\Admin\AppData\Local\Temp\5e78956ff1bbc6accc39fa00a5780f8191c6293d89b838669ee42f80fabcf0ce.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 126KB
- SHA256 bbf9ae87dbcabb02a1c936e54c722b64a048586b85bfd21e967928da3e38aa66
- MD5 fe12424005ed475ecfe22b812e98f1e4
- SHA1 07a0ec5683d7fac4938bf1261f7da3bee76edc5d
- SHA512 97c70e9476f1f14f5c761402913ebf99d48fb5b57bfe3d024c12cfd3e0000d3ce864098a0dd3c5477f6684b1ffe055e50ba39165dd249fd649c8f52acffdf65d
- SSDEEP 1536:PoXJ1oTKUbX/sw/LLRJjVY8Vxg5WDvOAAIZcIvvsswHFsqr:PoLoeqEeLLDBxAWSgcIvu6m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 126KB
- SHA256 3b002a31917f09f9348fecd564c84f74ed328528a82cb37796ecc9604bfb9c80
- MD5 d85e542668a7a69ed5465bdb035cba4f
- SHA1 af33f5675f06c438232dc4c6470a6422f2a88b56
- SHA512 6c83eb2f630d9b61fa0bddef2d791f3808ec321a2e4c2031bd1aa37ea2908ddd23453ae65ce73d3e40d41b91c6960480dcc4c1f1e2c426b83ca9e783f8524400
- SSDEEP 1536:PoXJ1oTKUbX/sw/LLRJjVY8Vxg5WDvOAAIZcIvvsswHFsqinnnnnnnnnnnnnnnnm:PoLoeqEeLLDBxAWSgcIvu6c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 126KB
- SHA256 7906d6c3f56b084dd35796dc9473ce080520bc4e5aaa0cf31d74022ff4c3d0e7
- MD5 569c6d809ad971314085c5294b55b1b2
- SHA1 7e32ae07216f51ab1e7d8f32a6e63d000ef633d4
- SHA512 e6f7ffa5d257d024fe2137273e5cc42efb476db0586e9d09495bcf4db4405ae8cef8db1f74e6f100bfea472f23dd2edad235d5545b1b772537ed2a114523e026
- SSDEEP 3072:PoLoeqEeLLDBxAWSgcIvu6peeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeP:PaMEaLDBxLvh
- MD5 SHA1 SHA512 SSDEEP