41474856991d239067ede8e26eaf36e60196a3ebe891aea1166aeeb36610e136

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f126c86b845490ab731aa3d721795330N.exe
Size

135KB
MD5

f126c86b845490ab731aa3d721795330
SHA1

40c154bca40f91d537668ac1c8355cea95789fb2
SHA256

41474856991d239067ede8e26eaf36e60196a3ebe891aea1166aeeb36610e136
SHA512

8bd0505f4020b216a556ed593193ab555ed4ec001b20c38784bae7623eaf3930869e74f44966f0704ce127faa30ae2dc33497898d30a5373677b200c8fe6a0b9
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVvUH:UVqoCl/YgjxEufVU0TbTyDDal1UH

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2944	explorer.exe
4708	spoolsv.exe
1900	svchost.exe
4588	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	f126c86b845490ab731aa3d721795330N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f126c86b845490ab731aa3d721795330N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2944	explorer.exe
1900	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2976	f126c86b845490ab731aa3d721795330N.exe
2976	f126c86b845490ab731aa3d721795330N.exe
2944	explorer.exe
2944	explorer.exe
4708	spoolsv.exe
4708	spoolsv.exe
1900	svchost.exe
1900	svchost.exe
4588	spoolsv.exe
4588	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2944	2976	f126c86b845490ab731aa3d721795330N.exe	85
PID 2976 wrote to memory of 2944	2976	f126c86b845490ab731aa3d721795330N.exe	85
PID 2976 wrote to memory of 2944	2976	f126c86b845490ab731aa3d721795330N.exe	85
PID 2944 wrote to memory of 4708	2944	explorer.exe	86
PID 2944 wrote to memory of 4708	2944	explorer.exe	86
PID 2944 wrote to memory of 4708	2944	explorer.exe	86
PID 4708 wrote to memory of 1900	4708	spoolsv.exe	87
PID 4708 wrote to memory of 1900	4708	spoolsv.exe	87
PID 4708 wrote to memory of 1900	4708	spoolsv.exe	87
PID 1900 wrote to memory of 4588	1900	svchost.exe	88
PID 1900 wrote to memory of 4588	1900	svchost.exe	88
PID 1900 wrote to memory of 4588	1900	svchost.exe	88

C:\Users\Admin\AppData\Local\Temp\f126c86b845490ab731aa3d721795330N.exe
"C:\Users\Admin\AppData\Local\Temp\f126c86b845490ab731aa3d721795330N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1900
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
d87bf617f9fe55298850a37472e85d81

SHA1
de30f98d9277f35880b7ff0999f1f8b6e4c415a3

SHA256
b121923c9d34fd2134298c7b4d85fde298c77985c369226abed6d9e03117098f

SHA512
e1cea45762844e4d5d9a80b87cbfcf136d69764851c01fef94f7374d751b740b6809cac83bbab1fcd13adc59f2fff5b66a55be051d608829fd37635207bcec82

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
d6f8478c4817360eabb2b6ffc6e9b2a2

SHA1
b9ab1194f5a200b14d708776a5af66087d2a90a0

SHA256
164b16ee0381605084c4f541c74953bf237aa6678004b0eb455d7c896ab73ded

SHA512
97a600e6620ad7203f98f28adc9040bdaf1a6ceea3293f78162ef5d47a0be5a2e4afa6ad0eb3e974ee7ceffc0b2c41170e53fa2c94d067c3f999da994c6727bc

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
adc3ae9dfb5ba06acaf287dbd2a98d48

SHA1
4190a8a3c6182609b186f7172fc9cccd500756bd

SHA256
deb639b8a134e2edc670c818d333d34d4eeabd4d15cce0a7010338e2bf0dd34d

SHA512
006913a4cd99e65712690ca3db97e9efabec2c4db4c37d39b39bb1c88d1502d76d4a83bf7f1fe132e3445187a9abc655a5289e993ea915bead63478353615e52

Download Submit
memory/1900-37-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2944-36-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2976-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2976-35-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4588-33-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4708-18-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4708-34-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download