Analysis
- max time kernel
150s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 04:58
Behavioral task
behavioral1
Sample
e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe
- Size 2.5MB
- Sample240603-flstnacc3w
- SHA256 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0
- MD5 0308475f60c760d705ec0fd72324b061
- SHA1 b9f7034481c99c6bddfd80f4fbac2b8656765055
- SHA512 76084f259535e8394acc0f471a6c883f7e8e4e090fdad830e993e29b3eed5deae4b35018477fd1a46f6c77fe42c881dbc495fc83de6030b3af35bea71f3faca3
- SSDEEP 49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxm:hxx9NUFkQx753uWuCyyxm
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Detects executables packed with Themida 16 IoCs
resource yara_rule behavioral2/memory/4044-0-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/files/0x0008000000023493-8.dat INDICATOR_EXE_Packed_Themida behavioral2/memory/3192-10-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/files/0x0008000000023494-15.dat INDICATOR_EXE_Packed_Themida behavioral2/memory/3196-19-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/files/0x0008000000023497-26.dat INDICATOR_EXE_Packed_Themida behavioral2/memory/4200-28-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/1728-33-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3196-41-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/1728-38-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4044-42-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3192-43-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3192-45-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4200-44-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4200-53-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3192-56-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe - Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe - Executes dropped EXE 4 IoCs
pid Process 3192 explorer.exe 3196 spoolsv.exe 4200 svchost.exe 1728 spoolsv.exe -
resource yara_rule behavioral2/memory/4044-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/files/0x0008000000023493-8.dat themida behavioral2/memory/3192-10-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/files/0x0008000000023494-15.dat themida behavioral2/memory/3196-19-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/files/0x0008000000023497-26.dat themida behavioral2/memory/4200-28-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/1728-33-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3196-41-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/1728-38-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4044-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3192-43-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3192-45-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4200-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4200-53-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3192-56-0x0000000000400000-0x0000000000A0E000-memory.dmp themida - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 3192 explorer.exe 3196 spoolsv.exe 4200 svchost.exe 1728 spoolsv.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3192 explorer.exe 4200 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 3192 explorer.exe 3192 explorer.exe 3196 spoolsv.exe 3196 spoolsv.exe 4200 svchost.exe 4200 svchost.exe 1728 spoolsv.exe 1728 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4044 wrote to memory of 3192 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 82 PID 4044 wrote to memory of 3192 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 82 PID 4044 wrote to memory of 3192 4044 e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe 82 PID 3192 wrote to memory of 3196 3192 explorer.exe 85 PID 3192 wrote to memory of 3196 3192 explorer.exe 85 PID 3192 wrote to memory of 3196 3192 explorer.exe 85 PID 3196 wrote to memory of 4200 3196 spoolsv.exe 86 PID 3196 wrote to memory of 4200 3196 spoolsv.exe 86 PID 3196 wrote to memory of 4200 3196 spoolsv.exe 86 PID 4200 wrote to memory of 1728 4200 svchost.exe 87 PID 4200 wrote to memory of 1728 4200 svchost.exe 87 PID 4200 wrote to memory of 1728 4200 svchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe"C:\Users\Admin\AppData\Local\Temp\e6f81866e2b116044b44bbaf3d5c95debbf9e99822350b30704f03126db9acb0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 2.5MB
- SHA256 d2a72fea32afff3c2b50f2bb570286754ca7a2c773f4df607c0196415bf0afaf
- MD5 fa5c3faa71029f16db76a8147d1dee32
- SHA1 2f35630faca2da82d45b29078235cde856ef420e
- SHA512 8e17b543e2e5dd887e9cf12cd3ac4c8fa0e4cd5cd4f3252dec87904ad0ba62c4172f42458c5c935cf8a6363a35bfcb14f5c00c6a52b029c7f9871e33b4d0185b
- SSDEEP 49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxd:hxx9NUFkQx753uWuCyyxd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 2.5MB
- SHA256 d47a8c265614a6ecc9d3387f1002bb0678e0d5cd280ed5ba9a26b43f9f094beb
- MD5 faf7100efa5fce0f84d33b0b6ee41f03
- SHA1 89f7e98674d57e4d80f67ff66a85dd96aebcd1af
- SHA512 fab19c0bf88d4dca4da9e054b73bc9791821bca99af9fb62e7cc4506e021f3b229750fca8d83c665a9e072f4eb818a95fa9c73e508d84580b6966437b24308f3
- SSDEEP 49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxv:hxx9NUFkQx753uWuCyyxv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 2.5MB
- SHA256 eccc20052eea3e3809706148fcca7d5ce91fe71c413f5839908f5ee56106acc3
- MD5 45b01493bd48f757bff2d2962051f066
- SHA1 dbddc81c5e332e44266e6ea660a62222bccdaa1b
- SHA512 0a5422bf5d26c48b1db01476c8e11eec2479e9b42fc87cbda4b9a897c3cfc72b16a6346343a3aedcd3cfc7dc1e585e4f681e4d0af716ce412738980583aad784
- SSDEEP 49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx7:hxx9NUFkQx753uWuCyyx7
- MD5 SHA1 SHA512 SSDEEP