Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 23:48
Behavioral task
behavioral1
Sample
8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe
Resource
win10v2004-20240611-en
General
-
Target
8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe
-
Size
2.5MB
-
MD5
38b0a3344a4c27382d09d1d2b2488039
-
SHA1
9884bbeb3e2310f8f17a2d801c63793ee526c8b8
-
SHA256
8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd
-
SHA512
937b233dd90600a33de4e1f13ecbbcd30431de5c32445c35da55c4bd9fdba0aadafb9803192114455f3bd74888e9aa885a10dfa3e6b964c15607b10f2331fdf8
-
SSDEEP
49152:gxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxB:gxx9NUFkQx753uWuCyyxB
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Detects executables packed with Themida 18 IoCs
Processes:
resource yara_rule behavioral2/memory/1212-0-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\Themes\explorer.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/1660-10-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\spoolsv.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/5012-19-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\svchost.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/720-28-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2344-33-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/1212-42-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5012-41-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2344-38-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/1660-43-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/720-44-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/1660-45-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/720-51-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/720-55-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/1660-56-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/1660-64-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exe8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 1660 explorer.exe 5012 spoolsv.exe 720 svchost.exe 2344 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/1212-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral2/memory/1660-10-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral2/memory/5012-19-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\svchost.exe themida behavioral2/memory/720-28-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2344-33-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/1212-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/5012-41-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2344-38-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/1660-43-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/720-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/1660-45-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/720-51-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/720-55-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/1660-56-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/1660-64-0x0000000000400000-0x0000000000A0E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
Processes:
spoolsv.exesvchost.exespoolsv.exe8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1660 explorer.exe 5012 spoolsv.exe 720 svchost.exe 2344 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exespoolsv.exe8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exedescription ioc process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exeexplorer.exepid process 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 1660 explorer.exe 720 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe 1660 explorer.exe 1660 explorer.exe 5012 spoolsv.exe 5012 spoolsv.exe 720 svchost.exe 720 svchost.exe 2344 spoolsv.exe 2344 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 1212 wrote to memory of 1660 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe explorer.exe PID 1212 wrote to memory of 1660 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe explorer.exe PID 1212 wrote to memory of 1660 1212 8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe explorer.exe PID 1660 wrote to memory of 5012 1660 explorer.exe spoolsv.exe PID 1660 wrote to memory of 5012 1660 explorer.exe spoolsv.exe PID 1660 wrote to memory of 5012 1660 explorer.exe spoolsv.exe PID 5012 wrote to memory of 720 5012 spoolsv.exe svchost.exe PID 5012 wrote to memory of 720 5012 spoolsv.exe svchost.exe PID 5012 wrote to memory of 720 5012 spoolsv.exe svchost.exe PID 720 wrote to memory of 2344 720 svchost.exe spoolsv.exe PID 720 wrote to memory of 2344 720 svchost.exe spoolsv.exe PID 720 wrote to memory of 2344 720 svchost.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe"C:\Users\Admin\AppData\Local\Temp\8f13b266dba9ff242106a321be847263bd5b9f8c50109abb02e182b09fb722fd.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2344
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5e6b9e4e2f2e7a6c01454ec313abd5418
SHA10969cb1e8b2712583475f8c5a89a14bf7ca614c2
SHA256e1e61c379ff1c4517753c401e8e9e8babbf6f44f1b79cd4bbbf032e6d441df63
SHA512d4c82670a28f368ebe4eee232e2837a1e85e18e216499c6338c6667c794d6b531d63d3ae761552efead0eb85c32abff6b0521462ed0ffa3b33dda80e0454740b
-
Filesize
2.5MB
MD58a60f054b553b69862e4b25fd3e190a0
SHA179c30b2d97de9280ca02bd7ab6d4c334d555582a
SHA256b26bfd058cf7df9d895e60b910cc7ae44f681845b310e544fda0c093f02af574
SHA5126500bd391128cccbd6019106391b1b76d5ed7f5f18114f850742884f921226ebec895764cc2b5182ff18a5f4659fdbda2e37fd1165018631d9a057931e2a8ef1
-
Filesize
2.5MB
MD5aa2b9d59f6c736c6d7d4298c1bc7c113
SHA11a63d5a06eb4515a2f0b0cf7739187c7f94be68e
SHA25653a82a8b9d594a77f89458f86f0116e10629827d1087e26f4a449887d470b5e8
SHA5128b6d1bcfe9965b098bd545eff3b31fdda3ea194533e879ddb970a13469426331b3a31061aa741b59ff89a898a422c8c334e9caa5229d4a89cc906766d66bb24f