Analysis

  • max time kernel
    154s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 03:52

General

  • Target

    ccb25053ffe7d2cae635531053b0545d93403d3194960066ed1a695fd517affe.exe

  • Size

    3.6MB

  • MD5

    4cc0ae9f491fbdf5382c58453eb0031f

  • SHA1

    a96c616d576feac5e747ae9677992fe9b05956bf

  • SHA256

    ccb25053ffe7d2cae635531053b0545d93403d3194960066ed1a695fd517affe

  • SHA512

    d47e2dd836205afc7faf91304ed6ce3b3deda07ca7701d7bf8f9c79270f14bad5c54fef50046bab9cb1b63e0f325b7f17bf32f5ba83d733a5fce4cf134728a95

  • SSDEEP

    98304:UdByXcdnlLwOrI5Vfeg91hZOhkRpsinjW:Udien+OrFuBR6cW

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccb25053ffe7d2cae635531053b0545d93403d3194960066ed1a695fd517affe.exe
    "C:\Users\Admin\AppData\Local\Temp\ccb25053ffe7d2cae635531053b0545d93403d3194960066ed1a695fd517affe.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2916
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4176
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3884
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2980
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:1588
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4420 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4924

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\Themes\explorer.exe

      Filesize

      3.6MB

      MD5

      194ff42ed584744752f09c3ed0245f79

      SHA1

      26afd225a8155a18291df64e542b4ad259b0a56f

      SHA256

      021e9179159e2519921894e3346a793272dd5e7c0ae82887ad888560a7462f79

      SHA512

      47b9ddcb8e21bc90797f766229f643aa794101f31082e75fffe2a9565907e73a7eb7749940aed8a3477d339846a43bf5913d18d4abc3568f19895f3bbce72ccd

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      3.6MB

      MD5

      6d8bf0877d099489750bf1925079a13f

      SHA1

      e699c9a0afc597f270b0830236018739a7047eb7

      SHA256

      6c0279c3f4f38627d1622db2c872205cc44964bf63833bf644a6c6b51ee3ac41

      SHA512

      8940c2c5df4b67da0cf4357efe3ade25d559a82e6fe2c3649cf92b8d0fc379982742e460618df93c6e5e0e045443a541683d75d075f71f89d3d9b8894f49f4cd

    • C:\Windows\Resources\svchost.exe

      Filesize

      3.6MB

      MD5

      81b9788968750bd858d3380db3cc0fe9

      SHA1

      6866c4fe4b64720b83477eacc8595e39271248ee

      SHA256

      f20b67c5ce865f3cd7e83e6b00a402ee2d1f058adf4bcd4e5bb4b5d687c84321

      SHA512

      8e0fc12c145d2a9d11342c0a269049c988e71fea11b787546ddca3828847227ebd8587dbc6b4c8062b2a46848c0b85e382b7d8b1f2b6b894706ecdaead57a9fe

    • memory/1588-35-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/1588-39-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2916-41-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2916-1-0x0000000077832000-0x0000000077833000-memory.dmp

      Filesize

      4KB

    • memory/2916-2-0x0000000077833000-0x0000000077834000-memory.dmp

      Filesize

      4KB

    • memory/2916-5-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2916-0-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2916-20-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2916-27-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-47-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-55-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-67-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-44-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-65-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-63-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-61-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-49-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-59-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-51-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-57-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/2980-53-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/3884-21-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/3884-42-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-60-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-52-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-58-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-50-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-54-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-56-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-62-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-46-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-45-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-66-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-43-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB

    • memory/4176-68-0x0000000000400000-0x0000000000784000-memory.dmp

      Filesize

      3.5MB