6a1056c7de935ac3c6a076cf4523ce72a37292d43675c447857a430b96a5e544

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

948564152f8f88071c3ee41f4bfce2a0N.exe
Size

206KB
MD5

948564152f8f88071c3ee41f4bfce2a0
SHA1

ab731b2617b0f613192b6afb18ede8eb1ca40d7b
SHA256

6a1056c7de935ac3c6a076cf4523ce72a37292d43675c447857a430b96a5e544
SHA512

69d6864dae496cfaa10391d142d3ec084531288e0042551b2839fb4707e7d34f13ea36760a3d307eae6f8ce7936116732de03007e8678240996f5797a8dfbd49
SSDEEP

3072:/VqoCl/YgjxEufVU0TbTyDDalbmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm3:/sLqdufVUNDao

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2740	explorer.exe
2360	spoolsv.exe
5028	svchost.exe
2780	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	948564152f8f88071c3ee41f4bfce2a0N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	948564152f8f88071c3ee41f4bfce2a0N.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2740	explorer.exe
5028	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
3504	948564152f8f88071c3ee41f4bfce2a0N.exe
2740	explorer.exe
2740	explorer.exe
2360	spoolsv.exe
2360	spoolsv.exe
5028	svchost.exe
5028	svchost.exe
2780	spoolsv.exe
2780	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 2740	3504	948564152f8f88071c3ee41f4bfce2a0N.exe	84
PID 3504 wrote to memory of 2740	3504	948564152f8f88071c3ee41f4bfce2a0N.exe	84
PID 3504 wrote to memory of 2740	3504	948564152f8f88071c3ee41f4bfce2a0N.exe	84
PID 2740 wrote to memory of 2360	2740	explorer.exe	86
PID 2740 wrote to memory of 2360	2740	explorer.exe	86
PID 2740 wrote to memory of 2360	2740	explorer.exe	86
PID 2360 wrote to memory of 5028	2360	spoolsv.exe	87
PID 2360 wrote to memory of 5028	2360	spoolsv.exe	87
PID 2360 wrote to memory of 5028	2360	spoolsv.exe	87
PID 5028 wrote to memory of 2780	5028	svchost.exe	88
PID 5028 wrote to memory of 2780	5028	svchost.exe	88
PID 5028 wrote to memory of 2780	5028	svchost.exe	88

C:\Users\Admin\AppData\Local\Temp\948564152f8f88071c3ee41f4bfce2a0N.exe
"C:\Users\Admin\AppData\Local\Temp\948564152f8f88071c3ee41f4bfce2a0N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2740
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5028
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
206KB

MD5
6a6ae647d59a4e056ac9430ed9e735b9

SHA1
b31c258cf44469869c11a213da55d43c9ccfeffb

SHA256
f47063b15d99efb9a4fb492533c484bcfc89958800bbef63b027b29deaef7d66

SHA512
50eb025c13ed567390943332c248d17679436fc66a2106bc8a8402d3ee023889fdba57cb3cdfc01e4920eb2c926b7bca0d306d9d3e27e906afb3a5cfceef41a4

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
206KB

MD5
4c8830f1a2dd985ca2ffb75a5f37c819

SHA1
1f02bf05c833a05c173f65545465d69a18fa797a

SHA256
daf467e058873bd35c0456a777b9dcabc66bad89b832c9a08e8772ff1d4fe7d5

SHA512
862f0a3809567d93012350edde535c3fee0bb4edd338b5b8e16625d536315765fc069faabba36e9510076a8c8d7ae9022a198859f38caaec297a8c541699f229

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
206KB

MD5
870680f4db4ff202c99a7eaa6527f797

SHA1
8edad69ecc638ffc2b90db017d8a58f9fa19fe83

SHA256
e8c144cf228d5270dacd74a2d4f3447ebfbd4ee922a0305119e003c5800ca89f

SHA512
214e41904c976a1dff4ff6f452ab4e2b861c58ba376e64c5831267b41f1c3d6175d2a555c2485210b9cdd7a981756f598adfbdfe8b49ab767a9a619b8b9fcfac

Download Submit
memory/2360-34-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2740-36-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2780-30-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2780-33-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3504-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3504-35-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5028-37-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download