Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 09:17

General

  • Target

    8cc042c84aa3b910a6a8af2b9e5d64b0N.exe

  • Size

    206KB

  • MD5

    8cc042c84aa3b910a6a8af2b9e5d64b0

  • SHA1

    6d98cad862ff6eae9ae6fcbe50dd0f4ba4d19159

  • SHA256

    eb872a057436f78449d2eb3149fa07ec7278ccd1797e5038a734966a2f4f430c

  • SHA512

    eab97c8c9c623ca7c5b65fec64e18f654a27a4d1656b2ece6249a749ff736f14ea9215148fedda76358dbcb47c8d02f0ed1b0cd0dbd44d50a320a96c8be2e989

  • SSDEEP

    1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdi:/VqoCl/YgjxEufVU0TbTyDDalbi

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cc042c84aa3b910a6a8af2b9e5d64b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\8cc042c84aa3b910a6a8af2b9e5d64b0N.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2464
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1620
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2892
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2864
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3000
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:19 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2712
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:20 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:348
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2708

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\Resources\spoolsv.exe

            Filesize

            206KB

            MD5

            f19472a94e388bebf74be25e601ae22a

            SHA1

            87e8f90af52a418d8390717387d9c755aea5e5f0

            SHA256

            cee5840905bbbd3b6153f8026273747389313be8b651d4539b8230d8ff8f710b

            SHA512

            a84c4aa4a82d679fb0d1714b805595ac8324b4e1da817b0ea74131076bfd289debd480980df2dd4e1a226e4a433408c959fd78e85b6ddda3b7671f20ed8aa273

          • \Windows\Resources\Themes\explorer.exe

            Filesize

            206KB

            MD5

            61ee523c148bb0d0d860503e2d5f927d

            SHA1

            ca973f064f16ab8c95711519b8abb9862ba7e049

            SHA256

            0294c939d8c9ed19001e0332d75b140982ae726b100588a74b25ab7a4e919d9f

            SHA512

            753433ffae989703c7ffc5cfc80411bcf77dd21797992a26e20182fe27b81524fb4ee98fde934bd514c9948550310c163e34f9f9c8383963a93e843989c8faeb

          • \Windows\Resources\svchost.exe

            Filesize

            206KB

            MD5

            bb7411e08801a5ea15dd172d6818ec5b

            SHA1

            9206e9e998db937021600a6fa0f0904385813ca4

            SHA256

            1113e138a783ca58cddeda3a4d0f77d0617d7412b823570e96aa5e2d3ca5c037

            SHA512

            eb6e0e383f441e572b95238300e48908b71176c10e7b3c830a0cb44063a4e7b9ef8290e9c4c3a44d2fef882e42bb7612283706c00fb76ab4b7278a9c7d416de5

          • memory/1620-56-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2464-55-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2464-14-0x00000000003C0000-0x00000000003EF000-memory.dmp

            Filesize

            188KB

          • memory/2464-13-0x00000000003C0000-0x00000000003EF000-memory.dmp

            Filesize

            188KB

          • memory/2464-0-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2864-58-0x0000000000390000-0x00000000003BF000-memory.dmp

            Filesize

            188KB

          • memory/2864-57-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2892-42-0x0000000000270000-0x000000000029F000-memory.dmp

            Filesize

            188KB

          • memory/2892-54-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2892-41-0x0000000000270000-0x000000000029F000-memory.dmp

            Filesize

            188KB

          • memory/3000-53-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB