Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 03:52

General

  • Target

    ccb25053ffe7d2cae635531053b0545d93403d3194960066ed1a695fd517affe.exe

  • Size

    3.6MB

  • MD5

    4cc0ae9f491fbdf5382c58453eb0031f

  • SHA1

    a96c616d576feac5e747ae9677992fe9b05956bf

  • SHA256

    ccb25053ffe7d2cae635531053b0545d93403d3194960066ed1a695fd517affe

  • SHA512

    d47e2dd836205afc7faf91304ed6ce3b3deda07ca7701d7bf8f9c79270f14bad5c54fef50046bab9cb1b63e0f325b7f17bf32f5ba83d733a5fce4cf134728a95

  • SSDEEP

    98304:UdByXcdnlLwOrI5Vfeg91hZOhkRpsinjW:Udien+OrFuBR6cW

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccb25053ffe7d2cae635531053b0545d93403d3194960066ed1a695fd517affe.exe
    "C:\Users\Admin\AppData\Local\Temp\ccb25053ffe7d2cae635531053b0545d93403d3194960066ed1a695fd517affe.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1792
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1276
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2644
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2672
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2568
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:54 /f
            5⤵
            • Creates scheduled task(s)
            PID:2548
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:55 /f
            5⤵
            • Creates scheduled task(s)
            PID:1620
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:56 /f
            5⤵
            • Creates scheduled task(s)
            PID:1532
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2588

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      3.6MB

      MD5

      bf3626aca5cb1dfa96615abeda94dea8

      SHA1

      ecd29ba5de46082dbec1cb91f9e45fd898148717

      SHA256

      427361dc65a40f09ae09ae835c523e420d65c08b0fd3717183573137708c48c5

      SHA512

      dc75d32765f04fd954f637d5a803dce24b221dbc66fb473384d60050d6cfd7122f7af1c7f50750ae5377a110a4b6b6610f739bdae42b49004385363c62340cdf

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      3.6MB

      MD5

      9349c7373904a0828f8e75f26c7b3aff

      SHA1

      320ca3efcf47dd3bb235e00288003864c8bb8fab

      SHA256

      be68e8069ba1c545086f448f9e6b858296ba3a669d455f4380205d572ce2f3eb

      SHA512

      c1be2c276c82ff3969a89db8d623bfd93b4a3c558a6909ca4dfe469374c51fb165e3f84670ffd606c32fe5defecaec7c0e74ea42313898bf9274bbdf4a1d84aa

    • \Windows\Resources\svchost.exe

      Filesize

      3.6MB

      MD5

      91778df29b255f658a097af6efd61cdc

      SHA1

      2bc471fd3b4c085ce83a5fcc45da8f50dd3e1589

      SHA256

      e45099cb410dc5e3ed290e96aeaf6366493dafdd678ab6d88725339805ac5306

      SHA512

      3f4030de1e40d3b5fd5a79b32fb33a186287465bdb2710ff35b95ce2b070dcd7b06cc3c2cc31425ab086d7a517dde93d9215e8b882a5b2d739bd94651368ee8e

    • memory/1276-56-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-76-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-68-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-21-0x0000000003AB0000-0x0000000003E34000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-64-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-70-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-80-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-62-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-60-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-72-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-58-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-11-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-53-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-78-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-55-0x0000000003AB0000-0x0000000003E34000-memory.dmp

      Filesize

      3.5MB

    • memory/1276-66-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1792-52-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1792-0-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1792-3-0x00000000776E0000-0x00000000776E1000-memory.dmp

      Filesize

      4KB

    • memory/2568-48-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2568-43-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2644-50-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2644-34-0x0000000003930000-0x0000000003CB4000-memory.dmp

      Filesize

      3.5MB

    • memory/2644-24-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-42-0x0000000003800000-0x0000000003B84000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-67-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-65-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-69-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-63-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-71-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-59-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-73-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-75-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-57-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-77-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-54-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-79-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-35-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2672-81-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB