Analysis
- max time kernel
150s - max time network
130s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
14/06/2024, 01:52
Behavioral task
behavioral1
Sample
9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe
Resource
win7-20240611-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe
- Size 57KB
- Sample240614-can5js1bpd
- SHA256 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0
- MD5 44b5b84e700fcd4138cbfe1e3e45a178
- SHA1 dc369efc1ca59d96704e8f317ad62a4dfc7aab51
- SHA512 9afc464593369eef9df894951fc6dd4b46b1457f4871a9756460c94bba8390f94ecddcf68c54b891e60bb7e8fd8b5b7be015fdebd6d7d775a0d7f0ca1dca9c0a
- SSDEEP 1536:6Ps27oLrMhknGu3uw3/55NpwCAawbtKFYpNUTIi:6Ps27krP13uIXNpwCwblrUIi
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - UPX dump on OEP (original entry point) 11 IoCs
resource yara_rule behavioral1/memory/1808-0-0x0000000000400000-0x0000000000422000-memory.dmp UPX behavioral1/files/0x000c00000001561c-6.dat UPX behavioral1/files/0x0008000000015c68-20.dat UPX behavioral1/memory/1648-23-0x0000000000240000-0x0000000000262000-memory.dmp UPX behavioral1/files/0x000a000000015c83-35.dat UPX behavioral1/memory/2656-53-0x0000000000400000-0x0000000000422000-memory.dmp UPX behavioral1/memory/2120-55-0x0000000000400000-0x0000000000422000-memory.dmp UPX behavioral1/memory/1808-57-0x0000000000400000-0x0000000000422000-memory.dmp UPX behavioral1/memory/1648-58-0x0000000000400000-0x0000000000422000-memory.dmp UPX behavioral1/memory/2632-61-0x0000000000400000-0x0000000000422000-memory.dmp UPX behavioral1/memory/1648-70-0x0000000000400000-0x0000000000422000-memory.dmp UPX - Executes dropped EXE 4 IoCs
pid Process 1648 explorer.exe 2120 spoolsv.exe 2632 svchost.exe 2656 spoolsv.exe - Loads dropped DLL 8 IoCs
pid Process 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1648 explorer.exe 1648 explorer.exe 2120 spoolsv.exe 2120 spoolsv.exe 2632 svchost.exe 2632 svchost.exe -
resource yara_rule behavioral1/memory/1808-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/files/0x000c00000001561c-6.dat upx behavioral1/files/0x0008000000015c68-20.dat upx behavioral1/memory/1648-23-0x0000000000240000-0x0000000000262000-memory.dmp upx behavioral1/files/0x000a000000015c83-35.dat upx behavioral1/memory/2656-53-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/2120-55-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/1808-57-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/1648-58-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/1648-59-0x0000000000240000-0x0000000000262000-memory.dmp upx behavioral1/memory/2632-61-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/1648-70-0x0000000000400000-0x0000000000422000-memory.dmp upx - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2492 schtasks.exe 940 schtasks.exe 3044 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 2632 svchost.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 1648 explorer.exe 2632 svchost.exe 2632 svchost.exe 1648 explorer.exe 1648 explorer.exe 2632 svchost.exe 1648 explorer.exe 2632 svchost.exe 1648 explorer.exe 2632 svchost.exe 1648 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1648 explorer.exe 2632 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 1648 explorer.exe 1648 explorer.exe 2120 spoolsv.exe 2120 spoolsv.exe 2632 svchost.exe 2632 svchost.exe 2656 spoolsv.exe 2656 spoolsv.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1648 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 28 PID 1808 wrote to memory of 1648 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 28 PID 1808 wrote to memory of 1648 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 28 PID 1808 wrote to memory of 1648 1808 9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe 28 PID 1648 wrote to memory of 2120 1648 explorer.exe 29 PID 1648 wrote to memory of 2120 1648 explorer.exe 29 PID 1648 wrote to memory of 2120 1648 explorer.exe 29 PID 1648 wrote to memory of 2120 1648 explorer.exe 29 PID 2120 wrote to memory of 2632 2120 spoolsv.exe 30 PID 2120 wrote to memory of 2632 2120 spoolsv.exe 30 PID 2120 wrote to memory of 2632 2120 spoolsv.exe 30 PID 2120 wrote to memory of 2632 2120 spoolsv.exe 30 PID 2632 wrote to memory of 2656 2632 svchost.exe 31 PID 2632 wrote to memory of 2656 2632 svchost.exe 31 PID 2632 wrote to memory of 2656 2632 svchost.exe 31 PID 2632 wrote to memory of 2656 2632 svchost.exe 31 PID 1648 wrote to memory of 2648 1648 explorer.exe 32 PID 1648 wrote to memory of 2648 1648 explorer.exe 32 PID 1648 wrote to memory of 2648 1648 explorer.exe 32 PID 1648 wrote to memory of 2648 1648 explorer.exe 32 PID 2632 wrote to memory of 2492 2632 svchost.exe 33 PID 2632 wrote to memory of 2492 2632 svchost.exe 33 PID 2632 wrote to memory of 2492 2632 svchost.exe 33 PID 2632 wrote to memory of 2492 2632 svchost.exe 33 PID 2632 wrote to memory of 940 2632 svchost.exe 38 PID 2632 wrote to memory of 940 2632 svchost.exe 38 PID 2632 wrote to memory of 940 2632 svchost.exe 38 PID 2632 wrote to memory of 940 2632 svchost.exe 38 PID 2632 wrote to memory of 3044 2632 svchost.exe 40 PID 2632 wrote to memory of 3044 2632 svchost.exe 40 PID 2632 wrote to memory of 3044 2632 svchost.exe 40 PID 2632 wrote to memory of 3044 2632 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe"C:\Users\Admin\AppData\Local\Temp\9ced60237e2f785a6c068a6a2a25b8c70f481f2faa7c8f82f41e66a6fea69de0.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:54 /f5⤵
- Creates scheduled task(s)
PID:2492
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:55 /f5⤵
- Creates scheduled task(s)
PID:940
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:56 /f5⤵
- Creates scheduled task(s)
PID:3044
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2648
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Windows\Resources\Themes\explorer.exe
- Size 57KB
- SHA256 0ff324ee9b7c5f26ca322500844a77d80461562416f72b4efaa56d594756ad7b
- MD5 59c594549c2ed5a879df0f6e60fde124
- SHA1 89a41526e44b70a66bff54382841eb18ab12210c
- SHA512 fa351cc2fc6d46e5cbd4115b9aad4c5ee6464e73c6b28a1bc72b0e443fd827d09da8d79cffc36c652e408e2087710c6fc9b6ce6814be0c794e1ee3a9f5460de5
- SSDEEP 1536:6Ps27oLrMhknGu3uw3/55NpwCAawbtKFYpNUTIQqqqqqqqqqqqqqqqqqqqqqqqqa:6Ps27krP13uIXNpwCwblrUIQqqqqqqqx
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Resources\spoolsv.exe
- Size 57KB
- SHA256 f70d8639557efa0ba8a97e5ff7f945341129f802b24513bbaae980918b91708b
- MD5 4b34156bb05786b1b1b520720c30697a
- SHA1 9d56daec539aa838c545f642b385b0604cdbcb20
- SHA512 44ec79a69d77cbc72ce5bc2acd9dad4ac32f054b9df025723d7779b7aa4080460a723ec9c30c949fd7cbe5ea2474fe04552c3baaf721e8ec65073becbf506acf
- SSDEEP 1536:6Ps27oLrMhknGu3uw3/55NpwCAawbtKFYpNUTI1:6Ps27krP13uIXNpwCwblrUI1
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Resources\svchost.exe
- Size 57KB
- SHA256 63e82ef4dc132e48e4bce5303960428ac0e58b934eef29d48d89c37ea7bec7e2
- MD5 b263211febb34b9d070fdc91ed8214bb
- SHA1 e9dd9db3b0acd0f0cd82c3df7a25967a14fde067
- SHA512 35d327880bf154620b603d0f4e5ca3d50a4a5659b7545f706cb58b9f6da6e6d97014255fa9786ad3eddffdb8e2fa0ac9e410dd591660ac74231fc73c01b9968c
- SSDEEP 1536:6Ps27oLrMhknGu3uw3/55NpwCAawbtKFYpNUTIj:6Ps27krP13uIXNpwCwblrUIj
- MD5 SHA1 SHA512 SSDEEP