5d8b37da2d1bdf1e08a8dc7c20255394a638abe9961240ce86dcadd0bcfa001f

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fba27a2612154e11b29526e2e4f898c0N.exe
Size

135KB
MD5

fba27a2612154e11b29526e2e4f898c0
SHA1

7649994a1355033271d9f49b494127abb07de0ba
SHA256

5d8b37da2d1bdf1e08a8dc7c20255394a638abe9961240ce86dcadd0bcfa001f
SHA512

e4a08023558c2303bd29da646f987ca02ca05f6c9de32672e606394f4343a7655087ba411e64f83d4aceb09541f476aa1800136a6497589fd1a55dd6948cd023
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVSaILLLLLLLLLLLT:UVqoCl/YgjxEufVU0TbTyDDalgaI

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2380	explorer.exe
2200	spoolsv.exe
2764	svchost.exe
2992	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2380	explorer.exe
2200	spoolsv.exe
2764	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	fba27a2612154e11b29526e2e4f898c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fba27a2612154e11b29526e2e4f898c0N.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1408	schtasks.exe
2912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2380	explorer.exe
2380	explorer.exe
2380	explorer.exe
2764	svchost.exe
2764	svchost.exe
2380	explorer.exe
2764	svchost.exe
2380	explorer.exe
2764	svchost.exe
2380	explorer.exe
2764	svchost.exe
2380	explorer.exe
2764	svchost.exe
2380	explorer.exe
2764	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2380	explorer.exe
2764	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2280	fba27a2612154e11b29526e2e4f898c0N.exe
2380	explorer.exe
2380	explorer.exe
2200	spoolsv.exe
2200	spoolsv.exe
2764	svchost.exe
2764	svchost.exe
2992	spoolsv.exe
2992	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2380	2280	fba27a2612154e11b29526e2e4f898c0N.exe	31
PID 2280 wrote to memory of 2380	2280	fba27a2612154e11b29526e2e4f898c0N.exe	31
PID 2280 wrote to memory of 2380	2280	fba27a2612154e11b29526e2e4f898c0N.exe	31
PID 2280 wrote to memory of 2380	2280	fba27a2612154e11b29526e2e4f898c0N.exe	31
PID 2380 wrote to memory of 2200	2380	explorer.exe	32
PID 2380 wrote to memory of 2200	2380	explorer.exe	32
PID 2380 wrote to memory of 2200	2380	explorer.exe	32
PID 2380 wrote to memory of 2200	2380	explorer.exe	32
PID 2200 wrote to memory of 2764	2200	spoolsv.exe	33
PID 2200 wrote to memory of 2764	2200	spoolsv.exe	33
PID 2200 wrote to memory of 2764	2200	spoolsv.exe	33
PID 2200 wrote to memory of 2764	2200	spoolsv.exe	33
PID 2764 wrote to memory of 2992	2764	svchost.exe	34
PID 2764 wrote to memory of 2992	2764	svchost.exe	34
PID 2764 wrote to memory of 2992	2764	svchost.exe	34
PID 2764 wrote to memory of 2992	2764	svchost.exe	34
PID 2380 wrote to memory of 2724	2380	explorer.exe	35
PID 2380 wrote to memory of 2724	2380	explorer.exe	35
PID 2380 wrote to memory of 2724	2380	explorer.exe	35
PID 2380 wrote to memory of 2724	2380	explorer.exe	35
PID 2764 wrote to memory of 2912	2764	svchost.exe	36
PID 2764 wrote to memory of 2912	2764	svchost.exe	36
PID 2764 wrote to memory of 2912	2764	svchost.exe	36
PID 2764 wrote to memory of 2912	2764	svchost.exe	36
PID 2764 wrote to memory of 1408	2764	svchost.exe	39
PID 2764 wrote to memory of 1408	2764	svchost.exe	39
PID 2764 wrote to memory of 1408	2764	svchost.exe	39
PID 2764 wrote to memory of 1408	2764	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\fba27a2612154e11b29526e2e4f898c0N.exe
"C:\Users\Admin\AppData\Local\Temp\fba27a2612154e11b29526e2e4f898c0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2380
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2764
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2992
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:40 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2912
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:41 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1408
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2552ee88f9ad5849e1af793587f5b8f2

SHA1
9f2b4057902cf9b6b04f703a2f13934a011d7032

SHA256
3e7ca06c75d79b0cb433b9aac2e8e43aec25f96963ca3103879a4779bffbcb0f

SHA512
51da8f1e0a9128df53bb3015968227f14403acd38d40ed5a0e5215ba947fdf60ec18ec0ac9d0b864ffd5f70ed4a8bed8d064c51af1034a8863dd74ea7dad4563

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
abb1d91c387521234878bf95a0321aed

SHA1
f29b15dcc28bbeab0e027af5da29e70c5e9ccc61

SHA256
bf4c3f3abaf9b809c561595d2ab1e18a8a2a4959aeb5484f15dd4610ecc60698

SHA512
3229108d4b07eca2791402bf79fa1a67958fa4fedd0a0bb0891c90c5f80d59352615258cf64229a3eab744a172dc1adabaccc5a7dc3055ce6de044a02de3da1d

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
0bbe903e02103efc7ea7cf71da498c24

SHA1
115a548f5e60c5f16f5d0e2dc4d896bfe66bfa5c

SHA256
aa337e779686afe091d5275d73d83148fc5aeb924ab6fc7a0a6bc4947261354d

SHA512
6287bdf163d2cf8b77fa4ef0abe0c16846272a5c9d5e4ec7b02a2d3d094625bda9a4821fb241c06a56b046ef694c163e77b1fb2ce353a1e9a0dab391562c2f71

Download Submit
memory/2200-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2280-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2280-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2380-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2764-35-0x0000000000280000-0x000000000029F000-memory.dmp

Filesize
124KB

Download
memory/2764-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2992-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download