Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 04:45
Behavioral task
behavioral1
Sample
e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe
Resource
win7-20240508-en
windows7-x64
13 signatures
150 seconds
General
- Target e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe
- Size 300KB
- Sample240603-fdfjcsdb57
- SHA256 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a
- MD5 caf8c0bc9c90ba2f4c0ec41b3ff39f82
- SHA1 ca8fb957e154678a3cf93b71e9fc3b5f2fddc222
- SHA512 db7c95f93575df9e27c68ee8a8d39a44eb436de88719fe0f753807891e358f700067d2e3d28339c6f0a8f97f077dcbd3cc4712216f472e27ed0cac4a878092ae
- SSDEEP 6144:HuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYU:O6Wq4aaE6KwyF5L0Y2D1PqLT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe - UPX dump on OEP (original entry point) 18 IoCs
resource yara_rule behavioral2/memory/4332-0-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/files/0x00080000000233fa-3.dat UPX behavioral2/files/0x001900000002293b-122.dat UPX behavioral2/memory/4332-714-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-1256-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-2310-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-3372-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-4692-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-5744-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-6802-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-7861-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-9177-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-10240-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-11292-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-12352-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-13667-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-14725-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/2340-15782-0x0000000000400000-0x00000000004C2000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 2340 svhost.exe -
resource yara_rule behavioral2/memory/4332-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x00080000000233fa-3.dat upx behavioral2/files/0x001900000002293b-122.dat upx behavioral2/memory/4332-714-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-1256-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-2310-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-3372-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-4692-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-5744-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-6802-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-7861-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-9177-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-10240-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-11292-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-12352-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-13667-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-14725-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2340-15782-0x0000000000400000-0x00000000004C2000-memory.dmp upx - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\k: svhost.exe - AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4332-714-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-1256-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-2310-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-3372-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-4692-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-5744-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-6802-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-7861-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-9177-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-10240-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-11292-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-12352-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-13667-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-14725-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2340-15782-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Driver.db svhost.exe File created C:\Windows\svhost.exe e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2340 svhost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe 2340 svhost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4332 wrote to memory of 2340 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 84 PID 4332 wrote to memory of 2340 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 84 PID 4332 wrote to memory of 2340 4332 e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe"C:\Users\Admin\AppData\Local\Temp\e0246e08713bc99a27008063ccae21db16d0d945cdcb1412b5c0d7820c83540a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs.exe
- Size 300KB
- SHA256 9e263c41b2b8eaf2156ea051e71a20ada9450a915f67f502c50dda9903ad82bc
- MD5 749a4240bc13ea0451f947124998f9a0
- SHA1 d40c5e3546b6bd7fc0c54086d6d09aec788aed2c
- SHA512 81d3b08404e841fc57aa5f4f46acaf70aea09bfee3c6c4c45423d18bb1dd49b861af42781de10846f7d13144005d1d93df22468c5ecbdffaaeb2aa621db6f239
- SSDEEP 6144:HuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYJ:O6Wq4aaE6KwyF5L0Y2D1PqLu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Driver.db
- Size 82B
- SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
- MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
- SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
- SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
- MD5 SHA1 SHA512
- Path C:\Windows\svhost.exe
- Size 300KB
- SHA256 04241b913b1f36ab37899856ef09e5975a658840590c1b3a8438a63f87cce338
- MD5 ec59b1616cf690edea7dc08c7e9e31d6
- SHA1 0ed70354a4d076931f84f0b94ebea01c952b0102
- SHA512 465615462fcb62107167bf56c2b00f1023af7cdb2f9a2bba00232855639603b8b9155e79692dadf644fbe506b1dc7b9c4b68d45b20b22d1baff362942fbecf1c
- SSDEEP 6144:HuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYY:O6Wq4aaE6KwyF5L0Y2D1PqL3
- MD5 SHA1 SHA512 SSDEEP