Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 09:17
Static task
static1
Behavioral task
behavioral1
Sample
8cc042c84aa3b910a6a8af2b9e5d64b0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8cc042c84aa3b910a6a8af2b9e5d64b0N.exe
Resource
win10v2004-20240802-en
General
-
Target
8cc042c84aa3b910a6a8af2b9e5d64b0N.exe
-
Size
206KB
-
MD5
8cc042c84aa3b910a6a8af2b9e5d64b0
-
SHA1
6d98cad862ff6eae9ae6fcbe50dd0f4ba4d19159
-
SHA256
eb872a057436f78449d2eb3149fa07ec7278ccd1797e5038a734966a2f4f430c
-
SHA512
eab97c8c9c623ca7c5b65fec64e18f654a27a4d1656b2ece6249a749ff736f14ea9215148fedda76358dbcb47c8d02f0ed1b0cd0dbd44d50a320a96c8be2e989
-
SSDEEP
1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdi:/VqoCl/YgjxEufVU0TbTyDDalbi
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 1620 explorer.exe 2892 spoolsv.exe 2864 svchost.exe 3000 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 1620 explorer.exe 1620 explorer.exe 2892 spoolsv.exe 2892 spoolsv.exe 2864 svchost.exe 2864 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2712 schtasks.exe 348 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 2864 svchost.exe 2864 svchost.exe 1620 explorer.exe 2864 svchost.exe 1620 explorer.exe 1620 explorer.exe 2864 svchost.exe 1620 explorer.exe 2864 svchost.exe 1620 explorer.exe 2864 svchost.exe 2864 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1620 explorer.exe 2864 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 1620 explorer.exe 1620 explorer.exe 2892 spoolsv.exe 2892 spoolsv.exe 2864 svchost.exe 2864 svchost.exe 3000 spoolsv.exe 3000 spoolsv.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2464 wrote to memory of 1620 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 30 PID 2464 wrote to memory of 1620 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 30 PID 2464 wrote to memory of 1620 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 30 PID 2464 wrote to memory of 1620 2464 8cc042c84aa3b910a6a8af2b9e5d64b0N.exe 30 PID 1620 wrote to memory of 2892 1620 explorer.exe 31 PID 1620 wrote to memory of 2892 1620 explorer.exe 31 PID 1620 wrote to memory of 2892 1620 explorer.exe 31 PID 1620 wrote to memory of 2892 1620 explorer.exe 31 PID 2892 wrote to memory of 2864 2892 spoolsv.exe 32 PID 2892 wrote to memory of 2864 2892 spoolsv.exe 32 PID 2892 wrote to memory of 2864 2892 spoolsv.exe 32 PID 2892 wrote to memory of 2864 2892 spoolsv.exe 32 PID 2864 wrote to memory of 3000 2864 svchost.exe 33 PID 2864 wrote to memory of 3000 2864 svchost.exe 33 PID 2864 wrote to memory of 3000 2864 svchost.exe 33 PID 2864 wrote to memory of 3000 2864 svchost.exe 33 PID 1620 wrote to memory of 2708 1620 explorer.exe 34 PID 1620 wrote to memory of 2708 1620 explorer.exe 34 PID 1620 wrote to memory of 2708 1620 explorer.exe 34 PID 1620 wrote to memory of 2708 1620 explorer.exe 34 PID 2864 wrote to memory of 2712 2864 svchost.exe 35 PID 2864 wrote to memory of 2712 2864 svchost.exe 35 PID 2864 wrote to memory of 2712 2864 svchost.exe 35 PID 2864 wrote to memory of 2712 2864 svchost.exe 35 PID 2864 wrote to memory of 348 2864 svchost.exe 38 PID 2864 wrote to memory of 348 2864 svchost.exe 38 PID 2864 wrote to memory of 348 2864 svchost.exe 38 PID 2864 wrote to memory of 348 2864 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cc042c84aa3b910a6a8af2b9e5d64b0N.exe"C:\Users\Admin\AppData\Local\Temp\8cc042c84aa3b910a6a8af2b9e5d64b0N.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:19 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2712
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:20 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:348
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2708
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5f19472a94e388bebf74be25e601ae22a
SHA187e8f90af52a418d8390717387d9c755aea5e5f0
SHA256cee5840905bbbd3b6153f8026273747389313be8b651d4539b8230d8ff8f710b
SHA512a84c4aa4a82d679fb0d1714b805595ac8324b4e1da817b0ea74131076bfd289debd480980df2dd4e1a226e4a433408c959fd78e85b6ddda3b7671f20ed8aa273
-
Filesize
206KB
MD561ee523c148bb0d0d860503e2d5f927d
SHA1ca973f064f16ab8c95711519b8abb9862ba7e049
SHA2560294c939d8c9ed19001e0332d75b140982ae726b100588a74b25ab7a4e919d9f
SHA512753433ffae989703c7ffc5cfc80411bcf77dd21797992a26e20182fe27b81524fb4ee98fde934bd514c9948550310c163e34f9f9c8383963a93e843989c8faeb
-
Filesize
206KB
MD5bb7411e08801a5ea15dd172d6818ec5b
SHA19206e9e998db937021600a6fa0f0904385813ca4
SHA2561113e138a783ca58cddeda3a4d0f77d0617d7412b823570e96aa5e2d3ca5c037
SHA512eb6e0e383f441e572b95238300e48908b71176c10e7b3c830a0cb44063a4e7b9ef8290e9c4c3a44d2fef882e42bb7612283706c00fb76ab4b7278a9c7d416de5