bd91f57efbfecc04f383a4e9db6cccdbeb349b42ff6314c65facd9a76ae19770

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e652ad33622788809eb5414a5c6acc30N.exe
Size

135KB
MD5

e652ad33622788809eb5414a5c6acc30
SHA1

cc35d6d806fdb0caeb7e69990a5f2478482b2265
SHA256

bd91f57efbfecc04f383a4e9db6cccdbeb349b42ff6314c65facd9a76ae19770
SHA512

e50109336c264dafb3c3f334c173855ae7fef88835dba6917b0207e53be4704dfa8e5e92be7980d279aa464c634bd0bfe734b1de888486a616b8eb876eb55d0e
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVmP:UVqoCl/YgjxEufVU0TbTyDDalQP

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2704	explorer.exe
2712	spoolsv.exe
2672	svchost.exe
2884	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
1312	e652ad33622788809eb5414a5c6acc30N.exe
2704	explorer.exe
2712	spoolsv.exe
2672	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	e652ad33622788809eb5414a5c6acc30N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e652ad33622788809eb5414a5c6acc30N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2572	schtasks.exe
752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2672	svchost.exe
2704	explorer.exe
2672	svchost.exe
2672	svchost.exe
2704	explorer.exe
2704	explorer.exe
2672	svchost.exe
2704	explorer.exe
2672	svchost.exe
2704	explorer.exe
2704	explorer.exe
2672	svchost.exe
2672	svchost.exe
2704	explorer.exe
2704	explorer.exe
2672	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2704	explorer.exe
2672	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1312	e652ad33622788809eb5414a5c6acc30N.exe
1312	e652ad33622788809eb5414a5c6acc30N.exe
2704	explorer.exe
2704	explorer.exe
2712	spoolsv.exe
2712	spoolsv.exe
2672	svchost.exe
2672	svchost.exe
2884	spoolsv.exe
2884	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2704	1312	e652ad33622788809eb5414a5c6acc30N.exe	31
PID 1312 wrote to memory of 2704	1312	e652ad33622788809eb5414a5c6acc30N.exe	31
PID 1312 wrote to memory of 2704	1312	e652ad33622788809eb5414a5c6acc30N.exe	31
PID 1312 wrote to memory of 2704	1312	e652ad33622788809eb5414a5c6acc30N.exe	31
PID 2704 wrote to memory of 2712	2704	explorer.exe	32
PID 2704 wrote to memory of 2712	2704	explorer.exe	32
PID 2704 wrote to memory of 2712	2704	explorer.exe	32
PID 2704 wrote to memory of 2712	2704	explorer.exe	32
PID 2712 wrote to memory of 2672	2712	spoolsv.exe	33
PID 2712 wrote to memory of 2672	2712	spoolsv.exe	33
PID 2712 wrote to memory of 2672	2712	spoolsv.exe	33
PID 2712 wrote to memory of 2672	2712	spoolsv.exe	33
PID 2672 wrote to memory of 2884	2672	svchost.exe	34
PID 2672 wrote to memory of 2884	2672	svchost.exe	34
PID 2672 wrote to memory of 2884	2672	svchost.exe	34
PID 2672 wrote to memory of 2884	2672	svchost.exe	34
PID 2704 wrote to memory of 1948	2704	explorer.exe	35
PID 2704 wrote to memory of 1948	2704	explorer.exe	35
PID 2704 wrote to memory of 1948	2704	explorer.exe	35
PID 2704 wrote to memory of 1948	2704	explorer.exe	35
PID 2672 wrote to memory of 2572	2672	svchost.exe	36
PID 2672 wrote to memory of 2572	2672	svchost.exe	36
PID 2672 wrote to memory of 2572	2672	svchost.exe	36
PID 2672 wrote to memory of 2572	2672	svchost.exe	36
PID 2672 wrote to memory of 752	2672	svchost.exe	39
PID 2672 wrote to memory of 752	2672	svchost.exe	39
PID 2672 wrote to memory of 752	2672	svchost.exe	39
PID 2672 wrote to memory of 752	2672	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\e652ad33622788809eb5414a5c6acc30N.exe
"C:\Users\Admin\AppData\Local\Temp\e652ad33622788809eb5414a5c6acc30N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2672
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2884
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:57 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2572
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:58 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:752
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
675880317d5d756058b2191905b4cd28

SHA1
b962f516594f2889d80e8825bf7b7e5ecd4b7eb7

SHA256
d09b3fb5df7d3d0ff574c9531a1f823cfa68b22906df5edeea347dcc08b3fe30

SHA512
ccd032782c7e416cb1098bf904faf996181c2b6c74a160d8ba636a01890843cebd9c3a784470a8ee90423347bed595c167cdb615d00ec5601914e9cc95b95bef

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
18384ddc0d56067b94e39de9f64aabfd

SHA1
7c31615d02e83594982987af8cd5097f292efd7b

SHA256
83946ce4d5532e9fa2e3ea4e91ad4a6630e9eee31d840c4231b96635ce280d65

SHA512
27c48a6420b0bd60e843661b70309692628945b1ec887a62086aa2e5ffd2888760b9e65e63b7ca2a3bd162c2f1c0903cc94dcad193d2b29c8bdaa24f641ce790

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
e7019357fc0cc3b9178d568a82b44253

SHA1
0e01d313bd7fb5d94981669c720ab59c6ed05239

SHA256
0dc3d7a8e6e186c1df2524e849801ef5b1d9d4b4c2fb7d481c3321144eaf98f2

SHA512
808f69e519445eb6e62748533cf504d9bf53bd0fb4156cfad3e80ddf5acfcac5b80b041174a010cc364982abc7b96938027e21da50e28a57c5ac5ac0a11e07a6

Download Submit
memory/1312-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1312-10-0x00000000005B0000-0x00000000005CF000-memory.dmp

Filesize
124KB

Download
memory/1312-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2672-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2672-47-0x00000000004A0000-0x00000000004BF000-memory.dmp

Filesize
124KB

Download
memory/2704-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2712-27-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2712-32-0x0000000000310000-0x000000000032F000-memory.dmp

Filesize
124KB

Download
memory/2712-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2884-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download