f72d199285a8ed57069c13d1f0c52a4a80d94293d3e3d2ff1243f70fe0fa3655

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb60c82d8ff95c51ce617fe4657ead60N.exe
Size

1.9MB
MD5

eb60c82d8ff95c51ce617fe4657ead60
SHA1

97fb328eebf04f4c507825bedb53f82931049f17
SHA256

f72d199285a8ed57069c13d1f0c52a4a80d94293d3e3d2ff1243f70fe0fa3655
SHA512

1ad9761f2f5be1f1a01b915050b969da3063f2ca425ab2bb229c80fab03f8c9d03fa8ed394f8da8a40aa2fdd32e1322b077c33288c29eb5f6cb9188571cbec1c
SSDEEP

24576:kA6PgFgyMDWXtDlPZJ+gGJ/22pPqicApG9jPi1U:YPYMGDlPZJ+TeqPqicqMiG

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 5 IoCs

pid	Process
828	icsys.icn.exe
4812	explorer.exe
1864	spoolsv.exe
5032	svchost.exe
4364	spoolsv.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1036-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/files/0x00080000000234eb-9.dat	upx
behavioral2/files/0x00080000000234f2-16.dat	upx
behavioral2/files/0x00080000000234f4-25.dat	upx
behavioral2/files/0x00080000000234f6-33.dat	upx
behavioral2/memory/4364-39-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4364-44-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/1864-46-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/828-48-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/1036-50-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4812-51-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/5032-52-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4812-61-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	eb60c82d8ff95c51ce617fe4657ead60N.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe
828	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4812	explorer.exe
5032	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
1036	eb60c82d8ff95c51ce617fe4657ead60N.exe
828	icsys.icn.exe
828	icsys.icn.exe
4812	explorer.exe
4812	explorer.exe
1864	spoolsv.exe
1864	spoolsv.exe
5032	svchost.exe
5032	svchost.exe
4364	spoolsv.exe
4364	spoolsv.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 828	1036	eb60c82d8ff95c51ce617fe4657ead60N.exe	84
PID 1036 wrote to memory of 828	1036	eb60c82d8ff95c51ce617fe4657ead60N.exe	84
PID 1036 wrote to memory of 828	1036	eb60c82d8ff95c51ce617fe4657ead60N.exe	84
PID 828 wrote to memory of 4812	828	icsys.icn.exe	85
PID 828 wrote to memory of 4812	828	icsys.icn.exe	85
PID 828 wrote to memory of 4812	828	icsys.icn.exe	85
PID 4812 wrote to memory of 1864	4812	explorer.exe	86
PID 4812 wrote to memory of 1864	4812	explorer.exe	86
PID 4812 wrote to memory of 1864	4812	explorer.exe	86
PID 1864 wrote to memory of 5032	1864	spoolsv.exe	88
PID 1864 wrote to memory of 5032	1864	spoolsv.exe	88
PID 1864 wrote to memory of 5032	1864	spoolsv.exe	88
PID 5032 wrote to memory of 4364	5032	svchost.exe	89
PID 5032 wrote to memory of 4364	5032	svchost.exe	89
PID 5032 wrote to memory of 4364	5032	svchost.exe	89

C:\Users\Admin\AppData\Local\Temp\eb60c82d8ff95c51ce617fe4657ead60N.exe
"C:\Users\Admin\AppData\Local\Temp\eb60c82d8ff95c51ce617fe4657ead60N.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:828
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1864
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5032
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
43KB

MD5
b5449a3967b853f4c82dad20e863aa93

SHA1
f023b2ce4e5ff40b75724d30195d03439e36a1d4

SHA256
0f88f3931ac63d1695f92ecea10acc9c474cfd94a1ed3f3fcbeb6a77397b644f

SHA512
ee0890d1611f9f507203b9d3a8a7bb9eb88c93a01cc69fd0d5b7f97cacdf3313ec9e317173d307b765b40579ac5a0c38733dea4728b98d1a90704d08f836a426

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
43KB

MD5
695e834c689ed0f22c1edae12d6491f9

SHA1
2a5a20946e8ad183555cfd5b8a31a0187b8f813f

SHA256
22e327d97c03285618b65471e43c5bb67e84c7a3a768fac96a56f6cf482310f2

SHA512
ea9ce54f9c2ae9f04d454c5fb59ed6236800281851a5002cb03e8c667dd36a3dadef6b5cd74df4de038f2c5aa48962f90ffd2c3ebc564beed75dbd0b1c932c66

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
43KB

MD5
4e77674c7d3d6b6b272c398eac64294c

SHA1
45d68ebede3f4d3567e269efcae4c6a82de2043d

SHA256
cd4d3c9d7b52374eac4967ff48bae6771340c5ef755911a743183c205b59faf5

SHA512
574f984bea053008ce30ef72b35d7302d5d49c55bf41b4decabbe1b913f4a5b78eaa61ae716295beda697ca69e4acc56012440746a84326cca42170786c76fab

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
43KB

MD5
afd4fd4fd628d40e19019d739bddae82

SHA1
6eda10097ed17a66c72909314313c63fd0f10991

SHA256
31c8870514136b6ee20f7c23f4fbcb7f58cfa311798cd39e667dd26756979fcb

SHA512
85d8aff012dc4cdcb6c9ee5b978d4d84488ed5367d2a8937f110ae86cd2b94108962c8da5d4e6deeafe89dd9888cc7608fd63a2880976bde3af897c5b8b4849c

Download Submit
memory/828-48-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1036-50-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1036-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1864-46-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4364-44-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4364-39-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4812-51-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4812-61-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5032-52-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download