c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
Size

741KB
MD5

d0eae3535b6b0e9aa5acd3c4fcb248b3
SHA1

0343d67db96fb60246becbcabb615b82a78ca91d
SHA256

c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262
SHA512

a81b37b96d0e2e3345e22db90a5deeee845af3a970ef9075d625de9b7bf06c0951550369515c8c5af8c006957946b8cc1e0186c8eac13609782e944dedccb2a9
SSDEEP

12288:ltTuh645I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Ff:lIg4kt0Kd6F6CNzYhUiEWEYcw3

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2436	explorer.exe
2572	spoolsv.exe
1960	svchost.exe
2868	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2436	explorer.exe
2572	spoolsv.exe
1960	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs

pid	Process
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2436	explorer.exe
2572	spoolsv.exe
1960	svchost.exe
2868	spoolsv.exe
2436	explorer.exe
1960	svchost.exe
2436	explorer.exe
1960	svchost.exe
2436	explorer.exe
1960	svchost.exe
2436	explorer.exe
1960	svchost.exe
2436	explorer.exe
1960	svchost.exe
2436	explorer.exe
1960	svchost.exe
2436	explorer.exe
1960	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2872	schtasks.exe
1964	schtasks.exe
912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2572	spoolsv.exe
2572	spoolsv.exe
2572	spoolsv.exe
2572	spoolsv.exe
2572	spoolsv.exe
2572	spoolsv.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2436	explorer.exe
1960	svchost.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
2436	explorer.exe
2436	explorer.exe
2436	explorer.exe
2572	spoolsv.exe
2572	spoolsv.exe
2572	spoolsv.exe
1960	svchost.exe
1960	svchost.exe
1960	svchost.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2436	2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe	30
PID 2532 wrote to memory of 2436	2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe	30
PID 2532 wrote to memory of 2436	2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe	30
PID 2532 wrote to memory of 2436	2532	c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe	30
PID 2436 wrote to memory of 2572	2436	explorer.exe	31
PID 2436 wrote to memory of 2572	2436	explorer.exe	31
PID 2436 wrote to memory of 2572	2436	explorer.exe	31
PID 2436 wrote to memory of 2572	2436	explorer.exe	31
PID 2572 wrote to memory of 1960	2572	spoolsv.exe	32
PID 2572 wrote to memory of 1960	2572	spoolsv.exe	32
PID 2572 wrote to memory of 1960	2572	spoolsv.exe	32
PID 2572 wrote to memory of 1960	2572	spoolsv.exe	32
PID 1960 wrote to memory of 2868	1960	svchost.exe	33
PID 1960 wrote to memory of 2868	1960	svchost.exe	33
PID 1960 wrote to memory of 2868	1960	svchost.exe	33
PID 1960 wrote to memory of 2868	1960	svchost.exe	33
PID 2436 wrote to memory of 2984	2436	explorer.exe	34
PID 2436 wrote to memory of 2984	2436	explorer.exe	34
PID 2436 wrote to memory of 2984	2436	explorer.exe	34
PID 2436 wrote to memory of 2984	2436	explorer.exe	34
PID 1960 wrote to memory of 2872	1960	svchost.exe	35
PID 1960 wrote to memory of 2872	1960	svchost.exe	35
PID 1960 wrote to memory of 2872	1960	svchost.exe	35
PID 1960 wrote to memory of 2872	1960	svchost.exe	35
PID 1960 wrote to memory of 1964	1960	svchost.exe	39
PID 1960 wrote to memory of 1964	1960	svchost.exe	39
PID 1960 wrote to memory of 1964	1960	svchost.exe	39
PID 1960 wrote to memory of 1964	1960	svchost.exe	39
PID 1960 wrote to memory of 912	1960	svchost.exe	41
PID 1960 wrote to memory of 912	1960	svchost.exe	41
PID 1960 wrote to memory of 912	1960	svchost.exe	41
PID 1960 wrote to memory of 912	1960	svchost.exe	41

C:\Users\Admin\AppData\Local\Temp\c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe
"C:\Users\Admin\AppData\Local\Temp\c3a96c90fde86766c39fd6589dc1b4e66b6af9ca9b052f279237f32801d6c262.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2436
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1960
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:2868
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:33 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2872
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:34 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1964
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:35 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:912
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
741KB

MD5
00c1609c88c9f25c5bf2737e129ccd0c

SHA1
6edb94056a78407b22912c02434046df9779ec07

SHA256
7896320c7e0c212fe170d5f9363f0909fdfc51bf7843d29f2c8b7f6231b66cf7

SHA512
8aa13f7a236a0d3b95ea07cb881be0a798f5ad319652e4a457a4dd57436ac8f517b3f71f243e7fec35b6da42542d835d818a6182af68b8289f1a9c4370e27a13

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
741KB

MD5
14b1d3a6d30b7b07b9ab824448703b98

SHA1
28dae0c6f70767fcd87d9716d017d3207a7860cf

SHA256
103ed09ff66cd9a6dd78958d0461ebf43ebc75b0c53f5ef6af3ea183ce373929

SHA512
01c9056ec9b2697dd92a8c473b618b8c47a230bbad3fdb0fc0bf9731f7188851fa0ef9a728288ddf0f60b2e64b4fc13e6f701bd59b9fd4b32dce3e398e95d8a2

Download Submit
\Windows\Resources\svchost.exe

Filesize
741KB

MD5
ad1e19ce5206d5535d81b222d33c069a

SHA1
2974fc2e684c4dbc4b8a8ba2e5d0dca8b99f8997

SHA256
2887d68e13d6f7b1e9f3a55435d65e722f101c78da9faaabfd30b6b44fa1ddb5

SHA512
9ab83f860d00fc704107d08a0f1e594d532984cf78fd32f0ab55d408bea597e9945369cdecb7088ea497e0d2485989bdad3ccbbd2b07243f47da6ba4e59eea66

Download Submit
memory/1960-39-0x0000000003A80000-0x0000000003DF2000-memory.dmp

Filesize
3.4MB

Download
memory/1960-77-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-32-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-73-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-71-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-55-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-67-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-63-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-61-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-59-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-51-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-57-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/1960-53-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2436-52-0x0000000003C30000-0x0000000003FA2000-memory.dmp

Filesize
3.4MB

Download
memory/2436-54-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2436-50-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2436-58-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2436-62-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2436-66-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2436-10-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2532-0-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2532-49-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-47-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2572-31-0x0000000003ED0000-0x0000000004242000-memory.dmp

Filesize
3.4MB

Download
memory/2868-45-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download
memory/2868-40-0x0000000000400000-0x0000000000772000-memory.dmp

Filesize
3.4MB

Download