Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    24-08-2024 06:19

General

  • Target

    fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe

  • Size

    135KB

  • MD5

    56d1433864ff895e13e9aafdd6efa07b

  • SHA1

    cbaf83cc38f333a0366627d339a96aedf615195f

  • SHA256

    fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b

  • SHA512

    ba88460f70ff34dcac00fe5455c4d121ad312ae6e78fcd1afa5dd63ac6467a69c936cc9ed55740beef026a5b9975e717b74d539a964b46f00fac83f7caa554d6

  • SSDEEP

    1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbggiJ9:XVqoCl/YgjxEufVU0TbTyDDalRY9

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe
    "C:\Users\Admin\AppData\Local\Temp\fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2156
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1356
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2100
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2412
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2700
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 06:21 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2760
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 06:22 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1688
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 06:23 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1968
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2764

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      ceea0e7063722dd7048bf3c49393d4ae

      SHA1

      896fcc2a3340271424d5d0febb7e545ac0cad7ee

      SHA256

      5bd5e7c9e31d745a44f875a4842ac36e14a0b9241bfb9350c26f468dabbc68bc

      SHA512

      c2283540df4f88ad4addecd10f833b3ab8f7b1d95fee8fc3e69e3e2116e75185824e7c09374132f895cda5eb1628fd440f8c3c7dd3b562b1d5aaeed8d6192144

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      1f2a392e6649cc7f5f472670d519c0c0

      SHA1

      93914dc0262f3b0fcd0ca575a129148b7e60ab88

      SHA256

      bce46259fa6e72c10ba64247a147fcd2a47615bd8383bf75d0190b8ad4f6d424

      SHA512

      9c19a6060baf604a7a1b8df59874165998fb08bfae7162ca6affc16edf8d5e106759c2ad3fdc1fae3f213e7584de6416d0f46fcaddb3f9238fd9f7a3e63e07a2

    • \Windows\Resources\svchost.exe

      Filesize

      135KB

      MD5

      87debefafac74f053b3e545621e4d529

      SHA1

      4ed30f78464738b79dac28bd025ac2bfc06923c9

      SHA256

      a0fee653573775412bc7fe832f2ee08304bee2c19a1954ef7474a345633e827b

      SHA512

      a274f20888ca6b3d19ebd265961e583013d43a6a0c8f86121a820c706b50ec058e0192bace4872f1ac9d7fbd9f220154e8ffd7d9d996505520868770b1625349

    • memory/1356-43-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2100-41-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2156-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2156-42-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2412-35-0x0000000000420000-0x000000000043F000-memory.dmp

      Filesize

      124KB

    • memory/2412-44-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2412-45-0x0000000000420000-0x000000000043F000-memory.dmp

      Filesize

      124KB

    • memory/2700-40-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB