Analysis
- max time kernel
120s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 09:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc64fe181b85f336b574a586f438cce0N.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
dc64fe181b85f336b574a586f438cce0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
120 seconds
General
- Target dc64fe181b85f336b574a586f438cce0N.exe
- Size 206KB
- Sample240825-lh5xpsyfml
- SHA256 0e08d98ea870b2165baa3145f55701c9e3a5748588bb9acfb427e3f16d1a338f
- MD5 dc64fe181b85f336b574a586f438cce0
- SHA1 0b3289ba6c3a68a01003bbe2efc54097c48f472a
- SHA512 84cb25f8efc1858a5e6ac1ac865909b7d5b73a2973e2fd6654381bd87b9e2ad96a25c0f5410b9695bb091c759a5ea434de52bedd7e45ac0d9ced0c25267df01a
- SSDEEP 1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdy:/VqoCl/YgjxEufVU0TbTyDDalby
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 2800 explorer.exe 756 spoolsv.exe 4068 svchost.exe 4288 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe dc64fe181b85f336b574a586f438cce0N.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc64fe181b85f336b574a586f438cce0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2800 explorer.exe 4068 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4996 dc64fe181b85f336b574a586f438cce0N.exe 4996 dc64fe181b85f336b574a586f438cce0N.exe 2800 explorer.exe 2800 explorer.exe 756 spoolsv.exe 756 spoolsv.exe 4068 svchost.exe 4068 svchost.exe 4288 spoolsv.exe 4288 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4996 wrote to memory of 2800 4996 dc64fe181b85f336b574a586f438cce0N.exe 84 PID 4996 wrote to memory of 2800 4996 dc64fe181b85f336b574a586f438cce0N.exe 84 PID 4996 wrote to memory of 2800 4996 dc64fe181b85f336b574a586f438cce0N.exe 84 PID 2800 wrote to memory of 756 2800 explorer.exe 85 PID 2800 wrote to memory of 756 2800 explorer.exe 85 PID 2800 wrote to memory of 756 2800 explorer.exe 85 PID 756 wrote to memory of 4068 756 spoolsv.exe 86 PID 756 wrote to memory of 4068 756 spoolsv.exe 86 PID 756 wrote to memory of 4068 756 spoolsv.exe 86 PID 4068 wrote to memory of 4288 4068 svchost.exe 88 PID 4068 wrote to memory of 4288 4068 svchost.exe 88 PID 4068 wrote to memory of 4288 4068 svchost.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc64fe181b85f336b574a586f438cce0N.exe"C:\Users\Admin\AppData\Local\Temp\dc64fe181b85f336b574a586f438cce0N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4288
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 206KB
- SHA256 305e354d41c178595c51d848bae4eae41064f4819808d11ee4f250198f22667d
- MD5 39fdd4779e639c1fd035fd735b421e3c
- SHA1 9048ee4f1febec99cdafe85471d5f5a9496594c0
- SHA512 5b5eed8a2d3341b8c4c7225ecc2ddc023962c78cf7f9f6f37620d3634499b9dedfefa897c54f963d88cd476f740114d95355d982d0d3a8ef4aff2cd93d2c8530
- SSDEEP 1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdI:/VqoCl/YgjxEufVU0TbTyDDalbI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 206KB
- SHA256 6a235a298753fa3a5305bae9b740efa8a2ff24a068f698e39b53f3dad3bc7e80
- MD5 6bab6eb69a2fee615701bc0c78e0aa41
- SHA1 244870dce04847a9d8b4fb0b37a125264ff3a3f2
- SHA512 b34de9e5269fd776ca3251cbfc6e9bf59dec6eebbc52edd18751ccc48e3af52db0440ec571c7f1b9d2db7b190ce67e246c98453c1ea058df827f3b17691dd1d5
- SSDEEP 1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJd3:/VqoCl/YgjxEufVU0TbTyDDalb3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 206KB
- SHA256 2aee84381f246679649ad3380f9ae0956b260678bea624f4418ffc52c174257f
- MD5 7c66821f8d182fb0730e879489e121a0
- SHA1 2fec9611c90a5aaa831a747e18e59f6a5f5b99f2
- SHA512 495624244139202e55ac7543785859b5238ee1f38ba49052cd70cc6e6b2da9738bf404dd6658d7b338b94db579cb6a6c1a96cabbedac9c7c5b2195752c3ab6ef
- SSDEEP 1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdq:/VqoCl/YgjxEufVU0TbTyDDalbq
- MD5 SHA1 SHA512 SSDEEP