Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe
Resource
win7-20240419-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe
-
Size
68KB
-
MD5
0604d8b4fd721dd7da5e7457a5c33bb8
-
SHA1
24b57eae2213d5a082d58608455c2d820572d5f4
-
SHA256
e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32
-
SHA512
c3556b8dc79147d3548296db09b44abcec991f7cf725bf97ee1786f0042217257cdc9ec6a8589379d4289bac3a757e597d8b5e0e1d117a028790ceecd737e4d9
-
SSDEEP
768:Ldsv/UDO00cfykvw8qqOve3ZVrt2F0mv9PIKr5LQ6hZDyVYUv5m/66sOWQHYNndh:KeO00cdVrMFjdF5L7hov5Eh4Br+KkCXr
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2644 winlog.exe 2756 SP00LSV.EXE 2492 SVCH0ST.EXE -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt SP00LSV.EXE -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Recycled.{645FF040-5081-101B-9F08-00AA002F954E} SP00LSV.EXE File opened for modification C:\Windows\SP00LSV.EXE winlog.exe File created C:\Windows\SVCH0ST.EXE SP00LSV.EXE File created C:\Windows\Recycled.{645FF040-5081-101B-9F08-00AA002F954E}\winlog.EXE SP00LSV.EXE File opened for modification C:\Windows\Recycled.{645FF040-5081-101B-9F08-00AA002F954E}\winlog.EXE SP00LSV.EXE File created C:\Windows\Recycled.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe SP00LSV.EXE File opened for modification C:\Windows\Recycled.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe SP00LSV.EXE File created C:\Windows\winlog.EXE e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe File opened for modification C:\Windows\winlog.EXE e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe File opened for modification C:\Windows\SVCH0ST.EXE SP00LSV.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\open\command SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Windows\\winlog.EXE %1" SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\Windows\\winlog.EXE %1" SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\open SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\explore\command SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\Windows\\winlog.EXE %1" SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vbsfile\shell\open\command SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ = "open" SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\open\command\ = "C:\\Windows\\winlog.EXE %1" SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\explore SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\explore\command\ = "C:\\Windows\\winlog.EXE %1" SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\winlog.EXE %1" SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\open\ = "??(&O) " SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\explore\ = "?????(&X) " SP00LSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command SP00LSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "C:\\Windows\\winlog.EXE %1" SP00LSV.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2756 SP00LSV.EXE 2756 SP00LSV.EXE 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2756 SP00LSV.EXE 2756 SP00LSV.EXE 2492 SVCH0ST.EXE 2492 SVCH0ST.EXE 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2756 SP00LSV.EXE 2756 SP00LSV.EXE 2492 SVCH0ST.EXE 2492 SVCH0ST.EXE 2644 winlog.exe 2644 winlog.exe 2756 SP00LSV.EXE 2756 SP00LSV.EXE 2492 SVCH0ST.EXE 2492 SVCH0ST.EXE 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2756 SP00LSV.EXE 2756 SP00LSV.EXE 2492 SVCH0ST.EXE 2492 SVCH0ST.EXE 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2756 SP00LSV.EXE 2756 SP00LSV.EXE 2492 SVCH0ST.EXE 2492 SVCH0ST.EXE 2644 winlog.exe 2644 winlog.exe 2756 SP00LSV.EXE 2756 SP00LSV.EXE 2492 SVCH0ST.EXE 2492 SVCH0ST.EXE 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2756 SP00LSV.EXE 2756 SP00LSV.EXE 2492 SVCH0ST.EXE 2492 SVCH0ST.EXE 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2644 winlog.exe 2756 SP00LSV.EXE 2756 SP00LSV.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2756 SP00LSV.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1008 e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe 2644 winlog.exe 2756 SP00LSV.EXE 2492 SVCH0ST.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1008 wrote to memory of 2644 1008 e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe 28 PID 1008 wrote to memory of 2644 1008 e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe 28 PID 1008 wrote to memory of 2644 1008 e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe 28 PID 1008 wrote to memory of 2644 1008 e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe 28 PID 2644 wrote to memory of 2756 2644 winlog.exe 29 PID 2644 wrote to memory of 2756 2644 winlog.exe 29 PID 2644 wrote to memory of 2756 2644 winlog.exe 29 PID 2644 wrote to memory of 2756 2644 winlog.exe 29 PID 2756 wrote to memory of 2492 2756 SP00LSV.EXE 30 PID 2756 wrote to memory of 2492 2756 SP00LSV.EXE 30 PID 2756 wrote to memory of 2492 2756 SP00LSV.EXE 30 PID 2756 wrote to memory of 2492 2756 SP00LSV.EXE 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe"C:\Users\Admin\AppData\Local\Temp\e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\winlog.exe"C:\Windows\winlog.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SP00LSV.EXE"C:\Windows\SP00LSV.EXE"3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SVCH0ST.EXE"C:\Windows\SVCH0ST.EXE"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2492
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5836d2fa36f768019167b6ac48f58bdad
SHA19e5ed6d4c78c64a09c8c1804f0c68ae0b225ad1b
SHA2569b387db163f089f6ed9700a96c49899edf59d20a2215d9e4970601eb905f2c72
SHA512774563e0d923f2dffa82b7f14d07bf318b7845398aa384d8a278693a67cf548754c3288e92a4f5d339aecc90484e6a87b0eea7abf59a89918cc37148edb8a102
-
Filesize
68KB
MD50604d8b4fd721dd7da5e7457a5c33bb8
SHA124b57eae2213d5a082d58608455c2d820572d5f4
SHA256e8040bf72f1c0fa67c6ffbf480265ec90dacf66424902bbc00b079546519ca32
SHA512c3556b8dc79147d3548296db09b44abcec991f7cf725bf97ee1786f0042217257cdc9ec6a8589379d4289bac3a757e597d8b5e0e1d117a028790ceecd737e4d9