Analysis
- max time kernel
120s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 11:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b667c6867669d0fdf808657e657c970N.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
8b667c6867669d0fdf808657e657c970N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
120 seconds
General
- Target 8b667c6867669d0fdf808657e657c970N.exe
- Size 206KB
- Sample240825-nw3evaserd
- SHA256 93dbbb285cde4ec916f8cfa72b18dbaced17756bea282c7964a07a8954260222
- MD5 8b667c6867669d0fdf808657e657c970
- SHA1 8b1876a6beb004442048f7b7b098e42193753de4
- SHA512 a74b508362d3a0bea7cb3650471a5c85e725f5b4762ccdf7c37a58bca414f3c03b46c1cef233c9fd785655a67ed0ae45f7543c57b94c43b1600263c12a22b52e
- SSDEEP 1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdlLLLLLLLLLLLLU:/VqoCl/YgjxEufVU0TbTyDDalbC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 4300 explorer.exe 4780 spoolsv.exe 3920 svchost.exe 1188 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 8b667c6867669d0fdf808657e657c970N.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b667c6867669d0fdf808657e657c970N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4300 explorer.exe 3920 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2332 8b667c6867669d0fdf808657e657c970N.exe 2332 8b667c6867669d0fdf808657e657c970N.exe 4300 explorer.exe 4300 explorer.exe 4780 spoolsv.exe 4780 spoolsv.exe 3920 svchost.exe 3920 svchost.exe 1188 spoolsv.exe 1188 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2332 wrote to memory of 4300 2332 8b667c6867669d0fdf808657e657c970N.exe 84 PID 2332 wrote to memory of 4300 2332 8b667c6867669d0fdf808657e657c970N.exe 84 PID 2332 wrote to memory of 4300 2332 8b667c6867669d0fdf808657e657c970N.exe 84 PID 4300 wrote to memory of 4780 4300 explorer.exe 85 PID 4300 wrote to memory of 4780 4300 explorer.exe 85 PID 4300 wrote to memory of 4780 4300 explorer.exe 85 PID 4780 wrote to memory of 3920 4780 spoolsv.exe 86 PID 4780 wrote to memory of 3920 4780 spoolsv.exe 86 PID 4780 wrote to memory of 3920 4780 spoolsv.exe 86 PID 3920 wrote to memory of 1188 3920 svchost.exe 87 PID 3920 wrote to memory of 1188 3920 svchost.exe 87 PID 3920 wrote to memory of 1188 3920 svchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b667c6867669d0fdf808657e657c970N.exe"C:\Users\Admin\AppData\Local\Temp\8b667c6867669d0fdf808657e657c970N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 206KB
- SHA256 003a8cd65e85ed891bf41ef5248dacadb71f6b27c1eec4ee7cdc22525128a71d
- MD5 e682990cfaddeeab088bdc3d11e84077
- SHA1 6137083f66ba8ca99704cbdd802e432c219888c1
- SHA512 dfad37b32db151b69996d61fb298b3bd7e987da1e06041d48fd151b83a7b15d700be86848cda55a1309d0f743d80bdd26b3a75061f69dda75a593be4630976a1
- SSDEEP 1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdN:/VqoCl/YgjxEufVU0TbTyDDalbN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 206KB
- SHA256 b0d3028c0bac47fc4b83b05e523963eaf03670c1e1428e14c5fe7d4805720699
- MD5 e93435563b25e04aa5ba05ed21bf2461
- SHA1 d326ba52e9e5082aaa1e39528ae65be178ff18a4
- SHA512 260c0929fea8f170d0d4c5d76c33dd6a87e65fd98c5d1a338c959abba8b4fe6a5794ccd02d987ae8fd5d7d588f7744177e99b9eb27b79d0a61efebd2054d6203
- SSDEEP 1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJd7:/VqoCl/YgjxEufVU0TbTyDDalb7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 206KB
- SHA256 55cc6d2404b710655785b47bcbd4c2dc7c95d5f9dd2a0dbe3d171517e0e98972
- MD5 39e60ba44a34e209f2d8114a1187e812
- SHA1 b7189d4e4749800633ae78dbe2d3b51f8d0afbf1
- SHA512 0cc29131fb4ea61665ebc1a0545a86a24b1384583aaaf0c7570d6f6e85fe14d5d41d525b68b58ffd9c9a59d14dcf7579b0c0b7dce5ac109df5885175d046a5f3
- SSDEEP 1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdI:/VqoCl/YgjxEufVU0TbTyDDalbI
- MD5 SHA1 SHA512 SSDEEP