Overview

overview

10

Static

static

7

c7a717e350...0N.exe

windows7-x64

10

c7a717e350...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2024, 23:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    c7a717e3502b53d0d753566eec4b1080N.exe

  • Size

    43KB

  • MD5

    c7a717e3502b53d0d753566eec4b1080

  • SHA1

    abff35a8830f9e60b23855457b1abc0801c2677b

  • SHA256

    35ac21ca37941278c1e832efe527b3ba112ea7aff0422cfa241caa10663cfc87

  • SHA512

    f2123c70bf87d36461aa8d53f7be9fa43458fef5f69a964e4a25a8428830b4397c36a4d82cb08c69a9bd3efca85c4d34ef192bc2e619bc0a060343ffdbb1f558

  • SSDEEP

    768:pB3Yvnl5pzqsgKnXpkoHS6KZIFhf8HuKWJI3HG+VVVb4pSN:zIvl5dKYXGB2IuPJIR9N

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7a717e3502b53d0d753566eec4b1080N.exe
    "C:\Users\Admin\AppData\Local\Temp\c7a717e3502b53d0d753566eec4b1080N.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2356
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:972
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:768
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1404
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2616

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\Resources\Themes\explorer.exe
          Filesize

          43KB

          MD5

          1b24e2c6b6450e526efb6cc696c24d87

          SHA1

          08645f2d97716b32bfb15fe4f8874488918151ed

          SHA256

          18f1b66d5b934bcdb66c2777a1e92073e2540da89d0df9f6caeb6b4ebc9290b1

          SHA512

          9d8e06311523ff7dfb6785a7aae68f3b29831b96d9036d7d255763a322d37c5e404b2425b49129ef5574714f4dfa101e5dbfa45737e3818c9f319fc4315995a0

          Download Submit

        • C:\Windows\Resources\spoolsv.exe
          Filesize

          43KB

          MD5

          ef9b655f8307044c1ee2fc9c88166e93

          SHA1

          4bec0ce6b2f5ff8b67b67efbf099b82be1dbbc66

          SHA256

          cb4397dcce0a6c503ee8177cd8901458ce1d27632166f32a451c651a17c0055c

          SHA512

          e79795e3c19183dbc4c38ac1b07e980b6442888fe82e5c3afb77812c3610c91e6164a96cae42f8c430098c30e86e3f21050b1cf4515c32bc2912bf6d5e95b2c4

          Download Submit

        • C:\Windows\Resources\svchost.exe
          Filesize

          43KB

          MD5

          7987ff84e01bb7b494552c5b37f2cefd

          SHA1

          6126e88231055f1c6af9dc183ed94d5a27765719

          SHA256

          3544a970e7f718eee07e3752b8b6ee27793a6a87ef5e91f74a7dbd3c61d94baf

          SHA512

          8db7cfbfadf74a3f7f77c005d428a56980f2605072c78be7119a691945db948f6c50e147fd61d5c0a97053ec83819921d5e2125ac6c10f83f158104415fe8527

          Download Submit

        • memory/768-34-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/972-37-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/972-49-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/1404-38-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2356-0-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2356-36-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2616-32-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download