1c939fa9a671d77f84658702d75a973c093dae31d042b80f58880e9ce2c3ad7d

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdc2c5c0240466671e0f52829e6fc910N.exe
Size

135KB
MD5

bdc2c5c0240466671e0f52829e6fc910
SHA1

29583fa846768870fa00329ccf3d0d1d5c22566e
SHA256

1c939fa9a671d77f84658702d75a973c093dae31d042b80f58880e9ce2c3ad7d
SHA512

fa6562230bf936f07395240dbae5aadd88c2472f954343a11f3d326934a00b6959798dd444662329cc9744e6e47aa10d8dbbced5e4182a10dca568cea6d229fb
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVk7:UVqoCl/YgjxEufVU0TbTyDDalu7

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3488	explorer.exe
4492	spoolsv.exe
3912	svchost.exe
4824	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	bdc2c5c0240466671e0f52829e6fc910N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdc2c5c0240466671e0f52829e6fc910N.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe
3488	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3488	explorer.exe
3912	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
4000	bdc2c5c0240466671e0f52829e6fc910N.exe
3488	explorer.exe
3488	explorer.exe
4492	spoolsv.exe
4492	spoolsv.exe
3912	svchost.exe
3912	svchost.exe
4824	spoolsv.exe
4824	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 3488	4000	bdc2c5c0240466671e0f52829e6fc910N.exe	85
PID 4000 wrote to memory of 3488	4000	bdc2c5c0240466671e0f52829e6fc910N.exe	85
PID 4000 wrote to memory of 3488	4000	bdc2c5c0240466671e0f52829e6fc910N.exe	85
PID 3488 wrote to memory of 4492	3488	explorer.exe	87
PID 3488 wrote to memory of 4492	3488	explorer.exe	87
PID 3488 wrote to memory of 4492	3488	explorer.exe	87
PID 4492 wrote to memory of 3912	4492	spoolsv.exe	88
PID 4492 wrote to memory of 3912	4492	spoolsv.exe	88
PID 4492 wrote to memory of 3912	4492	spoolsv.exe	88
PID 3912 wrote to memory of 4824	3912	svchost.exe	89
PID 3912 wrote to memory of 4824	3912	svchost.exe	89
PID 3912 wrote to memory of 4824	3912	svchost.exe	89

C:\Users\Admin\AppData\Local\Temp\bdc2c5c0240466671e0f52829e6fc910N.exe
"C:\Users\Admin\AppData\Local\Temp\bdc2c5c0240466671e0f52829e6fc910N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3488
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3912
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
a13095bcb28dbdff6e6a37165fa8baeb

SHA1
daaaab15fd7242b64fc00a74320081174bb199fa

SHA256
2c13b515913acd10be9de854eb2450d0a32d3d8277f62896f6bfc238025d626a

SHA512
6ce1df0c5dd2fda959aca9d16298d417c609293d6de9d673e1a34ee809da40b44297ff1caf0604e11f8b8246211a8bc4757d3219bdda34b389721e79ebec5cc4

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
883f39db271d2ce35263567d2a7ee5bd

SHA1
f3bfd507aa29633801f47ad8421fde62758dee31

SHA256
1276fbde081cd4d43352a53ab9a222f75faceb8358af28b5b73978fc77526cb6

SHA512
1befb611f16fa11adc04c8e7bb6b5a5d7924efa0ac85c6639fee32a74800f6ab9d37875ac96ae192d296494dc3479a76e1b49673cb4241028bed61bed0e192df

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
14aaa81166a88dee9d545cf7a3248c8a

SHA1
68cca6014443407a714da6bdafe11c44bafb3cec

SHA256
e06502cbf1df668956806aeb26287060a5d1149ee6ad606a07e9aee2c37961dc

SHA512
9516461e3f33445607b574e2ad2e6b8e5df29b43dc1c1e435cf9f56ce4fdd10d790ea0031fd37b9b160386ca9107a890ff6a89d28682821c98bc5f0a05f6c22a

Download Submit
memory/3488-35-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3912-36-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4000-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4000-34-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4492-33-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4824-32-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download