1be157cb50aad7c7701f0452c1cee83af1f92829ac626e269eb48bdb366dc2cf

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e22c5225bf67acd487a752c4a3a96a00N.exe
Size

135KB
MD5

e22c5225bf67acd487a752c4a3a96a00
SHA1

98bcfae35beb6f257d5ca8d7e3ee1904249032fc
SHA256

1be157cb50aad7c7701f0452c1cee83af1f92829ac626e269eb48bdb366dc2cf
SHA512

ff6528e60c978b4fba34b69f14a366b216eaf8c5e210b9d7651071538daf935256f97c23cf9ab4b3e23dc3369679fc23a3e2f60df3b9b235173f06edb13fd1e3
SSDEEP

1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgft:XVqoCl/YgjxEufVU0TbTyDDalkt

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2964	explorer.exe
2464	spoolsv.exe
1992	svchost.exe
2768	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2964	explorer.exe
2464	spoolsv.exe
1992	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	e22c5225bf67acd487a752c4a3a96a00N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e22c5225bf67acd487a752c4a3a96a00N.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2712	schtasks.exe
2832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
2964	explorer.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
1992	svchost.exe
2964	explorer.exe
1992	svchost.exe
2964	explorer.exe
2964	explorer.exe
1992	svchost.exe
1992	svchost.exe
2964	explorer.exe
2964	explorer.exe
1992	svchost.exe
1992	svchost.exe
2964	explorer.exe
1992	svchost.exe
2964	explorer.exe
2964	explorer.exe
1992	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1992	svchost.exe
2964	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2632	e22c5225bf67acd487a752c4a3a96a00N.exe
2964	explorer.exe
2964	explorer.exe
2464	spoolsv.exe
2464	spoolsv.exe
1992	svchost.exe
1992	svchost.exe
2768	spoolsv.exe
2768	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2964	2632	e22c5225bf67acd487a752c4a3a96a00N.exe	31
PID 2632 wrote to memory of 2964	2632	e22c5225bf67acd487a752c4a3a96a00N.exe	31
PID 2632 wrote to memory of 2964	2632	e22c5225bf67acd487a752c4a3a96a00N.exe	31
PID 2632 wrote to memory of 2964	2632	e22c5225bf67acd487a752c4a3a96a00N.exe	31
PID 2964 wrote to memory of 2464	2964	explorer.exe	32
PID 2964 wrote to memory of 2464	2964	explorer.exe	32
PID 2964 wrote to memory of 2464	2964	explorer.exe	32
PID 2964 wrote to memory of 2464	2964	explorer.exe	32
PID 2464 wrote to memory of 1992	2464	spoolsv.exe	33
PID 2464 wrote to memory of 1992	2464	spoolsv.exe	33
PID 2464 wrote to memory of 1992	2464	spoolsv.exe	33
PID 2464 wrote to memory of 1992	2464	spoolsv.exe	33
PID 1992 wrote to memory of 2768	1992	svchost.exe	34
PID 1992 wrote to memory of 2768	1992	svchost.exe	34
PID 1992 wrote to memory of 2768	1992	svchost.exe	34
PID 1992 wrote to memory of 2768	1992	svchost.exe	34
PID 2964 wrote to memory of 2976	2964	explorer.exe	35
PID 2964 wrote to memory of 2976	2964	explorer.exe	35
PID 2964 wrote to memory of 2976	2964	explorer.exe	35
PID 2964 wrote to memory of 2976	2964	explorer.exe	35
PID 1992 wrote to memory of 2712	1992	svchost.exe	36
PID 1992 wrote to memory of 2712	1992	svchost.exe	36
PID 1992 wrote to memory of 2712	1992	svchost.exe	36
PID 1992 wrote to memory of 2712	1992	svchost.exe	36
PID 1992 wrote to memory of 2832	1992	svchost.exe	39
PID 1992 wrote to memory of 2832	1992	svchost.exe	39
PID 1992 wrote to memory of 2832	1992	svchost.exe	39
PID 1992 wrote to memory of 2832	1992	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\e22c5225bf67acd487a752c4a3a96a00N.exe
"C:\Users\Admin\AppData\Local\Temp\e22c5225bf67acd487a752c4a3a96a00N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2964
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1992
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2768
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:45 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2712
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:46 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2832
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
2a5a7a8c328c6232fd6ed65197bbdafc

SHA1
39d099625cfd974e798f5d93b199793930042d25

SHA256
6714de43c16fab4e219fe21096fe32545da9f57b6e37c3962aeb33788019f96b

SHA512
76a120f2ec51060a78b73c3a5f6901e3322fdc32940024c5c6ccf4d74c0fc1c92629dc172759efc2b80f42f39b449e64d915e4045429190b5fc264abe91a7754

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
36a940425c7b23ccc7964191fc22cce2

SHA1
23101739d653e4d9e6409b92bf915f29e942aadf

SHA256
beb02507eae30faf3977ffb6c041ba6c00c861fe015736da5812d1bacb81424e

SHA512
1236b1a389c56fe520fb17f0cc6b2f9d3653db0cd8a501f19eaecdbf5115952bd4f118abd0b984b57f2e36536bd1d09323f8f922b197aed93de05d3580ac9344

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
018812e80af0da512f7c45b90913a6c3

SHA1
7df39e6dcbd0b88bd22bcfc12115a74d1af83523

SHA256
3976f20f500ca1c8fbf7e76f5a387129d007bbe0b48b142d0fdfef6c1045d39d

SHA512
fac71bedb1cfb8d460f34db3c3e6ab1cf710ed1ae127d4e58276c9b72e347ecd45eb8d9112e1e37da5099cb1270fdb5af10ed5fce5336f7a17391040e3eb23fb

Download Submit
memory/1992-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1992-46-0x0000000000270000-0x000000000028F000-memory.dmp

Filesize
124KB

Download
memory/2464-31-0x00000000003B0000-0x00000000003CF000-memory.dmp

Filesize
124KB

Download
memory/2464-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2632-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2632-10-0x0000000000310000-0x000000000032F000-memory.dmp

Filesize
124KB

Download
memory/2632-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2768-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2964-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download