Analysis
- max time kernel
150s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe
- Size 135KB
- Sample240614-eh47vathrb
- SHA256 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546
- MD5 cf152479e125abc4655e60e63608fed3
- SHA1 5447b033fa9e179efd2779cd995df04539b497ea
- SHA512 8b59eadbb7a46a628c2f15d456e4819086ebe64ea6691c9e27408af0fd268db37438a2b9a223c32e650b0dc27d8ee0a982fe3f44ae9f44e8b871d5b1ad923ccd
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVoXO:UVqoCl/YgjxEufVU0TbTyDDal0O
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 2980 explorer.exe 956 spoolsv.exe 3924 svchost.exe 3624 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe 2980 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2980 explorer.exe 3924 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 2980 explorer.exe 2980 explorer.exe 956 spoolsv.exe 956 spoolsv.exe 3924 svchost.exe 3924 svchost.exe 3624 spoolsv.exe 3624 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2980 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 84 PID 2516 wrote to memory of 2980 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 84 PID 2516 wrote to memory of 2980 2516 c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe 84 PID 2980 wrote to memory of 956 2980 explorer.exe 86 PID 2980 wrote to memory of 956 2980 explorer.exe 86 PID 2980 wrote to memory of 956 2980 explorer.exe 86 PID 956 wrote to memory of 3924 956 spoolsv.exe 87 PID 956 wrote to memory of 3924 956 spoolsv.exe 87 PID 956 wrote to memory of 3924 956 spoolsv.exe 87 PID 3924 wrote to memory of 3624 3924 svchost.exe 89 PID 3924 wrote to memory of 3624 3924 svchost.exe 89 PID 3924 wrote to memory of 3624 3924 svchost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe"C:\Users\Admin\AppData\Local\Temp\c8c0d0184c34282e5b0f436102a0a3d7317ff47586264d89187b3e3db1f7e546.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3624
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 7bbdcfa16ca8ceb7998adc39d82840abc2a604d434403330d8e5ab10370098ad
- MD5 eded2539443a80822c6492d4088546b7
- SHA1 a40c0b0bf4a30b2c6bae79278659438a7e94936b
- SHA512 09ba38baa4fcec2a3c6e3b6cb242924f8be6aebb9accb97e81de0417d23f7d7bbf6ededdb014d3a6d94be4139bfa6c5a4badaf5078080dc839cd24817cbc31b1
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVoXM:UVqoCl/YgjxEufVU0TbTyDDal0M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 28dcd85b033a3a548156bb7c94895c65553bbe70ba57805ae2fea19342fead05
- MD5 8797d844ad3eb71ed02b0b0f271ad535
- SHA1 c1324e14967f0aa686ee99dba292381b06fd22fb
- SHA512 e90093c8fa1aff2fdf1986d43e213bc4eeaf6e670e4dee22be1123f7e90a396b61ec81604d680e1565417a1b3fa3c67310f148da2df79953812e91fe5b3b89e6
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVoX4:UVqoCl/YgjxEufVU0TbTyDDal04
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 c2c902435073096b58a02d898d4291480b471bd706561bc5c6b13fd0acc48dad
- MD5 d3b629a392633891a9f7108f2add3a77
- SHA1 90c10d0260a4b7defca5da80bb049a2eb789db0c
- SHA512 49e703bf680c66e9474358b93f7dfcf355d914c040244141eae2e42a658ee92d791481fab2d468bca5b040774b555bffc6855544128fb545fa31430546e8157c
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVoXQdddddddddddj:UVqoCl/YgjxEufVU0TbTyDDal0K
- MD5 SHA1 SHA512 SSDEEP