Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe
-
Size
135KB
-
MD5
1d6017e309c94ec27a939844bb6e9c86
-
SHA1
8816f39672c1da0d0fa2b76b9114c014ca6374e9
-
SHA256
e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165
-
SHA512
d077f682f57b44a58e2ed68f05769d002b27a6ac72b9de5c1c379760566593086044cdd23723e95960a65c57026d27414cf23a0d38e5d5c9e0ee96dc36536e47
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVNX:UVqoCl/YgjxEufVU0TbTyDDalTX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 2864 explorer.exe 2176 spoolsv.exe 1272 svchost.exe 2552 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 2864 explorer.exe 2176 spoolsv.exe 1272 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2908 schtasks.exe 1736 schtasks.exe 1156 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 2864 explorer.exe 1272 svchost.exe 1272 svchost.exe 1272 svchost.exe 2864 explorer.exe 2864 explorer.exe 1272 svchost.exe 1272 svchost.exe 2864 explorer.exe 2864 explorer.exe 1272 svchost.exe 1272 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2864 explorer.exe 1272 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 2864 explorer.exe 2864 explorer.exe 2176 spoolsv.exe 2176 spoolsv.exe 1272 svchost.exe 1272 svchost.exe 2552 spoolsv.exe 2552 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1068 wrote to memory of 2864 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 28 PID 1068 wrote to memory of 2864 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 28 PID 1068 wrote to memory of 2864 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 28 PID 1068 wrote to memory of 2864 1068 e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe 28 PID 2864 wrote to memory of 2176 2864 explorer.exe 29 PID 2864 wrote to memory of 2176 2864 explorer.exe 29 PID 2864 wrote to memory of 2176 2864 explorer.exe 29 PID 2864 wrote to memory of 2176 2864 explorer.exe 29 PID 2176 wrote to memory of 1272 2176 spoolsv.exe 30 PID 2176 wrote to memory of 1272 2176 spoolsv.exe 30 PID 2176 wrote to memory of 1272 2176 spoolsv.exe 30 PID 2176 wrote to memory of 1272 2176 spoolsv.exe 30 PID 1272 wrote to memory of 2552 1272 svchost.exe 31 PID 1272 wrote to memory of 2552 1272 svchost.exe 31 PID 1272 wrote to memory of 2552 1272 svchost.exe 31 PID 1272 wrote to memory of 2552 1272 svchost.exe 31 PID 2864 wrote to memory of 2560 2864 explorer.exe 32 PID 2864 wrote to memory of 2560 2864 explorer.exe 32 PID 2864 wrote to memory of 2560 2864 explorer.exe 32 PID 2864 wrote to memory of 2560 2864 explorer.exe 32 PID 1272 wrote to memory of 2908 1272 svchost.exe 33 PID 1272 wrote to memory of 2908 1272 svchost.exe 33 PID 1272 wrote to memory of 2908 1272 svchost.exe 33 PID 1272 wrote to memory of 2908 1272 svchost.exe 33 PID 1272 wrote to memory of 1736 1272 svchost.exe 38 PID 1272 wrote to memory of 1736 1272 svchost.exe 38 PID 1272 wrote to memory of 1736 1272 svchost.exe 38 PID 1272 wrote to memory of 1736 1272 svchost.exe 38 PID 1272 wrote to memory of 1156 1272 svchost.exe 40 PID 1272 wrote to memory of 1156 1272 svchost.exe 40 PID 1272 wrote to memory of 1156 1272 svchost.exe 40 PID 1272 wrote to memory of 1156 1272 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe"C:\Users\Admin\AppData\Local\Temp\e38fe3d6ac7b8e0cfe73d0544404f12df5879a070fa50a3bcd32b58d1d6f3165.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2552
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:37 /f5⤵
- Creates scheduled task(s)
PID:2908
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:38 /f5⤵
- Creates scheduled task(s)
PID:1736
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:39 /f5⤵
- Creates scheduled task(s)
PID:1156
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2560
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD585a77f792450de128db4017628302eed
SHA10114f774e918dda7da1c3dd1572efd3142257e27
SHA256d32440419779cf5167cfa30f5427923367af954dc68c4dc98d7de0a16f653992
SHA512348cff381e00fc25bf5db92eb1838f98933d6549eb0317e1c96fb2b0c470fccf4ae803c589ee9e4d783aa77ad51a9ced75b8ee651ce97074dd0a3d5a37a83484
-
Filesize
135KB
MD5bfd84442f0cf6593005ae2e4182e7ce2
SHA13bbfdd97f33f727be9c5d79b3c5688aa27d43d4f
SHA2567112690b3d5f894d5f71f0625522138a8bb65584bbac36b8788168c1a1908320
SHA5129931e5e4c03d459bab61b6311a0a0b5ce628eb76792fa6bbb28059bf450b7bce167382f6ec20fa33419af84df5a87077e8ca34ccd005d6596c86ded420a94c7b
-
Filesize
135KB
MD56dcc3fc25a5819aae4895c15270d722c
SHA1827a3f5c6af14d4630fb831ca3af25d198b344cb
SHA256862cc126d53736de6bdb68a373b6f7db9c3b0e7833cb7347b4b246fc5585f764
SHA5127fd060cd5453056f3fdf3c97432dd07eafdba41f58e0bf1ba57e68444aa8865e0f0ec1f4dd631444b88cd396acdd802eae13d9d81d48718e775c8f28a88d755f