Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 00:50
Behavioral task
behavioral1
Sample
842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe
Resource
win7-20240508-en
windows7-x64
13 signatures
150 seconds
General
- Target 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe
- Size 368KB
- Sample240614-a67wesybna
- SHA256 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb
- MD5 9dfcd2d670601032f88ef0ff6f6c60bb
- SHA1 fbbac65433cb07588a9b65582083e1bd8febc100
- SHA512 44f64dad4d4e3faa578cc574b8b05acf9a70a787962a3e09ed712a4e9826a3bad06a3dbcee62cd2544b596e09df0ac8304033f27d0b56ca7c0596f9e2484209e
- SSDEEP 6144:zuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYWuIlWqB+ihabs7Cf:q6Wq4aaE6KwyF5L0Y2D1PqL+6Wq4aaEg
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe - UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral2/memory/992-0-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/files/0x0008000000023438-3.dat UPX behavioral2/memory/1908-5-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/files/0x000700000002343d-123.dat UPX behavioral2/memory/992-773-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-1313-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-2370-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-2638-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-3431-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-4489-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-5808-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-6869-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-7929-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-8983-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-10309-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-11368-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-12426-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-13479-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-14807-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/1908-15865-0x0000000000400000-0x00000000004C2000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 1908 svhost.exe -
resource yara_rule behavioral2/memory/992-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x0008000000023438-3.dat upx behavioral2/memory/1908-5-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x000700000002343d-123.dat upx behavioral2/memory/992-773-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-1313-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-2370-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-2638-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-3431-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-4489-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-5808-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-6869-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-7929-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-8983-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-10309-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-11368-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-12426-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-13479-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-14807-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1908-15865-0x0000000000400000-0x00000000004C2000-memory.dmp upx - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe - AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/992-773-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-1313-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-2370-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-2638-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-3431-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-4489-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-5808-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-6869-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-7929-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-8983-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-10309-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-11368-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-12426-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-13479-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-14807-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/1908-15865-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe File opened for modification C:\Windows\Driver.db svhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1908 svhost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe 1908 svhost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 992 wrote to memory of 1908 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 82 PID 992 wrote to memory of 1908 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 82 PID 992 wrote to memory of 1908 992 842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe"C:\Users\Admin\AppData\Local\Temp\842fbfc76fc8eb4c0c0da3c56f8ad8d0b4673b990e60fd0b86b13c3b3b9b54fb.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs.exe
- Size 368KB
- SHA256 c761cd95c2a5ce70dac2b380d4f7c78b7b9a5317efdcbba7f7d3c3d571ba6609
- MD5 c64807dc9b3e538d9296b4c41b9948e3
- SHA1 fc2f3c908272d292657e8607607f32764e8b6e1e
- SHA512 160ba834c95a098b0f83ee18cbeba59b91ac50c4cd0e945255e35d688b56bbd96141c2fc4f99f12197f4ce248c443b35723a843f4a3df1023d414a4b4fe7f77a
- SSDEEP 6144:zuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYWuIlWqB+ihabs7Co:q6Wq4aaE6KwyF5L0Y2D1PqL+6Wq4aaEf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Driver.db
- Size 82B
- SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
- MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
- SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
- SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
- MD5 SHA1 SHA512
- Path C:\Windows\svhost.exe
- Size 368KB
- SHA256 c5bf0f8920f74c9d149c72ec889ce7d2592c48c987e85ed4d6518ecdbc102610
- MD5 a3f92e0c2d00317e963c201e604dd957
- SHA1 e7eb28624227beb86e924746ffad27e20a22aced
- SHA512 22e2ed27ac7cfb644bf306b22e0fbd43f0db054b8b8ebe5f73478e28115fcf86067cb909fbc7f635e51b3f951e7bb6a61736a4422e6400066f8164aca5fcfb5f
- SSDEEP 6144:zuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYWuIlWqB+ihabs7Cy:q6Wq4aaE6KwyF5L0Y2D1PqL+6Wq4aaEl
- MD5 SHA1 SHA512 SSDEEP