Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
18/08/2024, 20:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe
- Size 135KB
- Sample240818-y26dssvgmp
- SHA256 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5
- MD5 a2414d2cdf8dacbf4c2f868e44dc8ed0
- SHA1 f41b57686469432b2b8ea8c87a6d566b04bf70f8
- SHA512 c046e990517dc4f7c00b8daa4b848ec01b4a18ba35e4e77d132a4e534be1523d24b40a095e8ee6a0e46a7074edda94cd860b4883d162e0a43f9a28f3b3369139
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVfIN:UVqoCl/YgjxEufVU0TbTyDDalhIN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 648 explorer.exe 2224 spoolsv.exe 1488 svchost.exe 2652 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe 648 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 648 explorer.exe 1488 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 648 explorer.exe 648 explorer.exe 2224 spoolsv.exe 2224 spoolsv.exe 1488 svchost.exe 1488 svchost.exe 2652 spoolsv.exe 2652 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2564 wrote to memory of 648 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 84 PID 2564 wrote to memory of 648 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 84 PID 2564 wrote to memory of 648 2564 3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe 84 PID 648 wrote to memory of 2224 648 explorer.exe 85 PID 648 wrote to memory of 2224 648 explorer.exe 85 PID 648 wrote to memory of 2224 648 explorer.exe 85 PID 2224 wrote to memory of 1488 2224 spoolsv.exe 86 PID 2224 wrote to memory of 1488 2224 spoolsv.exe 86 PID 2224 wrote to memory of 1488 2224 spoolsv.exe 86 PID 1488 wrote to memory of 2652 1488 svchost.exe 88 PID 1488 wrote to memory of 2652 1488 svchost.exe 88 PID 1488 wrote to memory of 2652 1488 svchost.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe"C:\Users\Admin\AppData\Local\Temp\3ade9c27fca0ac5cb88b3a497ad7ad4b8b2787e5bf4d13f4a4c9883f657bf0b5.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 637c219c8130ed5322a3694db9231bf7180d10693666017507025dc5cf98d443
- MD5 9fb6e96e96fe48c89babc39dd910128d
- SHA1 2f7de006fafbe120fb59fa57d9780c0612c5f8fe
- SHA512 00f26317564b097388e180c67aa7ad38fc2638c684df91b3f539ee3d35fb7aa0d814e18bfac7e792dfae12e0b1ccdea5e90a517c6b2419a05269f681a5916d7e
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVfIl:UVqoCl/YgjxEufVU0TbTyDDalhIl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 f223dab0c3a71999b83bd5ea745b28279e5c012b28f3ffcb64b03bb82d991268
- MD5 8bd8b714cb8f7d1d72838acb9b1c31b2
- SHA1 9e89259d95cfd2e81d889c087bc65fa06ead3a61
- SHA512 0af36bdff24548db3d655168010b1b7f0f80e790015f266c4bc5a96029150600ccff92d548758462ddeacec37dea9eac97344d0fc2b71f746554d3feb52545ce
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVfI6:UVqoCl/YgjxEufVU0TbTyDDalhI6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 3dfa562b5d6a732747309da99eb46dde9d6014028569b28b546cbcbba06450b2
- MD5 276e27142abd2576eb6a6ff69cce3f06
- SHA1 6ea4c8036e64930d8210c3112f4ad234580423c9
- SHA512 435664951288bca24e33431d6829c08afd8ba41d1cd64487826d2bfb2daab03ed097484555fde7ffa29857827fe05b234e858bd4fb1f2664be059c683e850722
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVfIT:UVqoCl/YgjxEufVU0TbTyDDalhIT
- MD5 SHA1 SHA512 SSDEEP