Overview

overview

10

Static

static

3

fc32d6d2d6...9b.exe

windows7-x64

10

fc32d6d2d6...9b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2024, 06:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe

  • Size

    135KB

  • MD5

    56d1433864ff895e13e9aafdd6efa07b

  • SHA1

    cbaf83cc38f333a0366627d339a96aedf615195f

  • SHA256

    fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b

  • SHA512

    ba88460f70ff34dcac00fe5455c4d121ad312ae6e78fcd1afa5dd63ac6467a69c936cc9ed55740beef026a5b9975e717b74d539a964b46f00fac83f7caa554d6

  • SSDEEP

    1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbggiJ9:XVqoCl/YgjxEufVU0TbTyDDalRY9

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe
    "C:\Users\Admin\AppData\Local\Temp\fc32d6d2d68e49c6305d3968dc16198babbc44a14fc09d846b27fbadf29dbe9b.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2052
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4844
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3896
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1584
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1816
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:8
    1⤵
      PID:4448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\Themes\explorer.exe
      Filesize

      135KB

      MD5

      967099d124e07076dfa183e8c968025c

      SHA1

      c5a4da6b62abd21a31cce77761367b8c1bff1008

      SHA256

      a6ffd63760e5b7d4796cf4ba9df0da7882a887cc8be2feca2be2f69bcdbe9572

      SHA512

      b8f63a8c7fbed1605da7fa9e7c0b92773f556f3f0e61c64e486245cabc414cc5ca6b034adcf79d4f145f2194445e00b9edde654a354a30a4a678c261cefab4a2

      Download Submit

    • C:\Windows\Resources\spoolsv.exe
      Filesize

      135KB

      MD5

      f2fc77ec1fe09554d10c67deddef82ac

      SHA1

      7757eb8f29412b3c8143660c24a81f7630f800a3

      SHA256

      d38feaa1de0185b10b2c274413e03eef4dd4b06b3c06922dbf34e012ebf873d3

      SHA512

      ff376b19e76574f91c7da77584b2c01472bb6a59ba2f927498629be5cab81083d50a3f9c4e7a140768da1efa493e22979f3a4dce108b44570c3a852aba0a1f1c

      Download Submit

    • C:\Windows\Resources\svchost.exe
      Filesize

      135KB

      MD5

      1eb5dbe536409880ec8e88b92d52d01f

      SHA1

      c45dd32fe703278807d8a23ee9dcbf626fb081a8

      SHA256

      557075af584c1c1c19e521e988cc7437a35dad68af14838e0ea1bf00ab17ad7b

      SHA512

      3fd655da9465e892affc378aad73f5736244c96d7dc49e40d6961953ea9a715dab22195813e7ec83994381532d04fb2ffadf6c148f2d88a151afed084a1e6aa4

      Download Submit

    • memory/1584-36-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/1816-32-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2052-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2052-34-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/3896-33-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/4844-35-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download