Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 21:14
Behavioral task
behavioral1
Sample
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe
Resource
win10v2004-20240508-en
General
-
Target
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe
-
Size
2.6MB
-
MD5
9bbd5c8e035c464c64c46e376878fc15
-
SHA1
9e09c3f7c4cb3bf9feebceb4d31d21a351e2d272
-
SHA256
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c
-
SHA512
669711508e62584b8466cd66297a28cdf11676b611d3db7a3a235329785f990571f7499e12c48c1af738fa8eb13d7c291bbfc9513070c1d0ad18d98938fd06e3
-
SSDEEP
49152:lS5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/YS:lS5G4DOT5JGIVzh/5aZX0zgd0IZGpwB
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Detects executables packed with Themida 16 IoCs
Processes:
resource yara_rule behavioral2/memory/2592-0-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\Themes\explorer.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/4916-10-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\spoolsv.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/4472-19-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\svchost.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/4456-28-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3340-33-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2592-41-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4472-40-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3340-38-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4916-42-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4456-43-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4456-53-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4916-54-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4456-63-0x0000000000400000-0x0000000000A13000-memory.dmp INDICATOR_EXE_Packed_Themida -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 4916 explorer.exe 4472 spoolsv.exe 4456 svchost.exe 3340 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/2592-0-0x0000000000400000-0x0000000000A13000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral2/memory/4916-10-0x0000000000400000-0x0000000000A13000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral2/memory/4472-19-0x0000000000400000-0x0000000000A13000-memory.dmp themida C:\Windows\Resources\svchost.exe themida behavioral2/memory/4456-28-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/3340-33-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/2592-41-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4472-40-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/3340-38-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4916-42-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4456-43-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4456-53-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4916-54-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4456-63-0x0000000000400000-0x0000000000A13000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe -
Processes:
spoolsv.exe501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exeexplorer.exespoolsv.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 4916 explorer.exe 4472 spoolsv.exe 4456 svchost.exe 3340 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exespoolsv.exe501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exedescription ioc process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exeexplorer.exepid process 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 4916 explorer.exe 4456 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe 4916 explorer.exe 4916 explorer.exe 4472 spoolsv.exe 4472 spoolsv.exe 4456 svchost.exe 4456 svchost.exe 3340 spoolsv.exe 3340 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 2592 wrote to memory of 4916 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe explorer.exe PID 2592 wrote to memory of 4916 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe explorer.exe PID 2592 wrote to memory of 4916 2592 501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe explorer.exe PID 4916 wrote to memory of 4472 4916 explorer.exe spoolsv.exe PID 4916 wrote to memory of 4472 4916 explorer.exe spoolsv.exe PID 4916 wrote to memory of 4472 4916 explorer.exe spoolsv.exe PID 4472 wrote to memory of 4456 4472 spoolsv.exe svchost.exe PID 4472 wrote to memory of 4456 4472 spoolsv.exe svchost.exe PID 4472 wrote to memory of 4456 4472 spoolsv.exe svchost.exe PID 4456 wrote to memory of 3340 4456 svchost.exe spoolsv.exe PID 4456 wrote to memory of 3340 4456 svchost.exe spoolsv.exe PID 4456 wrote to memory of 3340 4456 svchost.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe"C:\Users\Admin\AppData\Local\Temp\501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3340
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5cb96f0f358f3b0f12fa055c26810e1ff
SHA18fd060fe269c6be447263552a8e0b2bf99a1d31b
SHA256305dc6b8dbe5f9c5d068c440c9231565f8e938031a4b3cbaa61201d23dd2f8bd
SHA51262f22c884504d1ac86b4e41a497a3975cd55c7ede1e66c3934ac95bb505bab4d8ce6df063d57a74344ed155cf3d2e486c79c30008fa7c5a9d6bdabc224988b54
-
Filesize
2.6MB
MD5a3eba5e41287adfca86a3eaffea19beb
SHA112aff5bd5b150e9c73baa6cf57a5974e513a1e02
SHA256266be4375d2f3241930cfb2633e2f578f22a9d1d01e8dfdc243df3a49b52a18f
SHA5129f86aec53f3190aa1490a3a6d32f339567d4f0374f166827e3c6126def4d3133c84056d38cf646f4d8bfef6a6cabd4599947f6b723af053187caf03203268618
-
Filesize
2.6MB
MD5e87c00dbd4229cc31e9013a2d421d17b
SHA109b79925b25d284b71b8d5d8499727522363da54
SHA256cfb335858ea1bbb52f88151e5bdef7072457fc3223b8dbae100874b9864e5a5c
SHA512a988e591eb5cd266dcb222ea7823c1ee248638e5e5b655a77a81952861f7a591928abf434faaa4d3ef8c1ea9d39bd7cee8eb39ec46126ea4dd814548102c2fbd