Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-08-2024 06:19
Static task
static1
Behavioral task
behavioral1
Sample
fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe
Resource
win10v2004-20240802-en
General
-
Target
fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe
-
Size
135KB
-
MD5
56d1433864ff895e13e9aafdd6efa07b
-
SHA1
cbaf83cc38f333a0366627d339a96aedf615195f
-
SHA256
fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b
-
SHA512
ba88460f70ff34dcac00fe5455c4d121ad312ae6e78fcd1afa5dd63ac6467a69c936cc9ed55740beef026a5b9975e717b74d539a964b46f00fac83f7caa554d6
-
SSDEEP
1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbggiJ9:XVqoCl/YgjxEufVU0TbTyDDalRY9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 1356 explorer.exe 2100 spoolsv.exe 2412 svchost.exe 2700 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 1356 explorer.exe 2100 spoolsv.exe 2412 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2760 schtasks.exe 1688 schtasks.exe 1968 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 2412 svchost.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 2412 svchost.exe 2412 svchost.exe 1356 explorer.exe 2412 svchost.exe 1356 explorer.exe 2412 svchost.exe 1356 explorer.exe 2412 svchost.exe 1356 explorer.exe 2412 svchost.exe 1356 explorer.exe 2412 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1356 explorer.exe 2412 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 1356 explorer.exe 1356 explorer.exe 2100 spoolsv.exe 2100 spoolsv.exe 2412 svchost.exe 2412 svchost.exe 2700 spoolsv.exe 2700 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2156 wrote to memory of 1356 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 30 PID 2156 wrote to memory of 1356 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 30 PID 2156 wrote to memory of 1356 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 30 PID 2156 wrote to memory of 1356 2156 fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe 30 PID 1356 wrote to memory of 2100 1356 explorer.exe 31 PID 1356 wrote to memory of 2100 1356 explorer.exe 31 PID 1356 wrote to memory of 2100 1356 explorer.exe 31 PID 1356 wrote to memory of 2100 1356 explorer.exe 31 PID 2100 wrote to memory of 2412 2100 spoolsv.exe 32 PID 2100 wrote to memory of 2412 2100 spoolsv.exe 32 PID 2100 wrote to memory of 2412 2100 spoolsv.exe 32 PID 2100 wrote to memory of 2412 2100 spoolsv.exe 32 PID 2412 wrote to memory of 2700 2412 svchost.exe 33 PID 2412 wrote to memory of 2700 2412 svchost.exe 33 PID 2412 wrote to memory of 2700 2412 svchost.exe 33 PID 2412 wrote to memory of 2700 2412 svchost.exe 33 PID 1356 wrote to memory of 2764 1356 explorer.exe 34 PID 1356 wrote to memory of 2764 1356 explorer.exe 34 PID 1356 wrote to memory of 2764 1356 explorer.exe 34 PID 1356 wrote to memory of 2764 1356 explorer.exe 34 PID 2412 wrote to memory of 2760 2412 svchost.exe 35 PID 2412 wrote to memory of 2760 2412 svchost.exe 35 PID 2412 wrote to memory of 2760 2412 svchost.exe 35 PID 2412 wrote to memory of 2760 2412 svchost.exe 35 PID 2412 wrote to memory of 1688 2412 svchost.exe 39 PID 2412 wrote to memory of 1688 2412 svchost.exe 39 PID 2412 wrote to memory of 1688 2412 svchost.exe 39 PID 2412 wrote to memory of 1688 2412 svchost.exe 39 PID 2412 wrote to memory of 1968 2412 svchost.exe 41 PID 2412 wrote to memory of 1968 2412 svchost.exe 41 PID 2412 wrote to memory of 1968 2412 svchost.exe 41 PID 2412 wrote to memory of 1968 2412 svchost.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe"C:\Users\Admin\AppData\Local\Temp\fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2700
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 06:21 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2760
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 06:22 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1688
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 06:23 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1968
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2764
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5ceea0e7063722dd7048bf3c49393d4ae
SHA1896fcc2a3340271424d5d0febb7e545ac0cad7ee
SHA2565bd5e7c9e31d745a44f875a4842ac36e14a0b9241bfb9350c26f468dabbc68bc
SHA512c2283540df4f88ad4addecd10f833b3ab8f7b1d95fee8fc3e69e3e2116e75185824e7c09374132f895cda5eb1628fd440f8c3c7dd3b562b1d5aaeed8d6192144
-
Filesize
135KB
MD51f2a392e6649cc7f5f472670d519c0c0
SHA193914dc0262f3b0fcd0ca575a129148b7e60ab88
SHA256bce46259fa6e72c10ba64247a147fcd2a47615bd8383bf75d0190b8ad4f6d424
SHA5129c19a6060baf604a7a1b8df59874165998fb08bfae7162ca6affc16edf8d5e106759c2ad3fdc1fae3f213e7584de6416d0f46fcaddb3f9238fd9f7a3e63e07a2
-
Filesize
135KB
MD587debefafac74f053b3e545621e4d529
SHA14ed30f78464738b79dac28bd025ac2bfc06923c9
SHA256a0fee653573775412bc7fe832f2ee08304bee2c19a1954ef7474a345633e827b
SHA512a274f20888ca6b3d19ebd265961e583013d43a6a0c8f86121a820c706b50ec058e0192bace4872f1ac9d7fbd9f220154e8ffd7d9d996505520868770b1625349