Analysis
- max time kernel
150s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 07:29
Behavioral task
behavioral1
Sample
fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe
Resource
win7-20240704-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe
- Size 2.6MB
- Sample240825-jbljdasepf
- SHA256 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2
- MD5 65ad14555718406f2cddaf4760d18220
- SHA1 170bb28c6d050b5b5e4273b8f5cc1cd848b7feb0
- SHA512 0e0710b14b256a74f641baf460dabdc352ab29d0e72472279d68be2bac70f0d3b0ec3745caf281d7d8b46f43d87a05cb1739d89750ba3e2d1641266b7ac90652
- SSDEEP 49152:lW5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/Yn:lW5G4DOT5JGIVzh/5aZX0zgd0IZGpwW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe - Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe - Executes dropped EXE 4 IoCs
pid Process 2040 explorer.exe 208 spoolsv.exe 1264 svchost.exe 3004 spoolsv.exe -
resource yara_rule behavioral2/memory/1132-0-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/files/0x00080000000234bb-8.dat themida behavioral2/memory/2040-10-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/files/0x00080000000234bc-15.dat themida behavioral2/memory/208-19-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/files/0x00080000000234bf-26.dat themida behavioral2/memory/1264-28-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/3004-33-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/3004-38-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/1132-42-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/208-41-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/2040-43-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/2040-44-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/1264-45-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/2040-55-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/1264-56-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/2040-57-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/1264-68-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/2040-69-0x0000000000400000-0x0000000000A13000-memory.dmp themida - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 2040 explorer.exe 208 spoolsv.exe 1264 svchost.exe 3004 spoolsv.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2040 explorer.exe 1264 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 2040 explorer.exe 2040 explorer.exe 208 spoolsv.exe 208 spoolsv.exe 1264 svchost.exe 1264 svchost.exe 3004 spoolsv.exe 3004 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1132 wrote to memory of 2040 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 83 PID 1132 wrote to memory of 2040 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 83 PID 1132 wrote to memory of 2040 1132 fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe 83 PID 2040 wrote to memory of 208 2040 explorer.exe 87 PID 2040 wrote to memory of 208 2040 explorer.exe 87 PID 2040 wrote to memory of 208 2040 explorer.exe 87 PID 208 wrote to memory of 1264 208 spoolsv.exe 89 PID 208 wrote to memory of 1264 208 spoolsv.exe 89 PID 208 wrote to memory of 1264 208 spoolsv.exe 89 PID 1264 wrote to memory of 3004 1264 svchost.exe 90 PID 1264 wrote to memory of 3004 1264 svchost.exe 90 PID 1264 wrote to memory of 3004 1264 svchost.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe"C:\Users\Admin\AppData\Local\Temp\fc6532d54d67ccd62e02cfa8a583b5bc69b46e960106bf855211efb077f30fe2.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3004
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 2.6MB
- SHA256 1769378ff040c1f806b76eed763834f7776e8a48f301b51c2f4ec2d76c586795
- MD5 a7c2098cfcb6a846c0b17d7f0d779770
- SHA1 d491a4c63d6403795a4d066ea5892422c7a08e22
- SHA512 50fbf0d2e515b967ff8d7c4b1d5aa918aea434ecc6d9ca0ee275b3fb604d8251883e39eca9fea7ae89cd93f9c4efcfe46547e720831f423450a93379fcfbd67a
- SSDEEP 49152:lW5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/Yy:lW5G4DOT5JGIVzh/5aZX0zgd0IZGpwj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 2.6MB
- SHA256 45fe2e343907f3d5aafb193e0fc5e78eea2be3675ed9205cc345317e4a7e555e
- MD5 2f5580d20080e1d31d574cd7d58f655f
- SHA1 d900e43c4e46526afb6367221c8c46ebdbacca8e
- SHA512 b903d9239c8d448cb48b9a919edfa3fdd8ea1536efff913322f6ffdb8a9b4a6ed6054bd3d2ed0713f64ea2ca5697c6136404498419902cbd9ac9e16c6eb0b20f
- SSDEEP 49152:lW5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/Yy:lW5G4DOT5JGIVzh/5aZX0zgd0IZGpwt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 2.6MB
- SHA256 b0b6f3480c19e38d83373c32c37a7cf1edad91b0b40569239542dc40c8cab83a
- MD5 2db3c0e62a4dd5908c31272d46e9feac
- SHA1 08012a29c733337c6a8fe8a638a49fc09e950e13
- SHA512 b89f9e14d67eb7241fcd3d46e8304b37e6883ad0855180aea1df58adbef85679a61212bb3d4de33e85ab819f5a1049af2bab79e519a27d77dcb16eb35d01e11e
- SSDEEP 49152:lW5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/Yn:lW5G4DOT5JGIVzh/5aZX0zgd0IZGpw4
- MD5 SHA1 SHA512 SSDEEP