9458466a01f41f78a2e21cac0a3301793ccaf0474e6947075d1f63e597cdf2e9

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

530219f327f5e00ea04b0245bf6c1690N.exe
Size

135KB
MD5

530219f327f5e00ea04b0245bf6c1690
SHA1

f113be7c72f8ae985db7696e57f8028c33ac5600
SHA256

9458466a01f41f78a2e21cac0a3301793ccaf0474e6947075d1f63e597cdf2e9
SHA512

97fb185b17b19aa2fab3ed6ce3569642601fe161bb67335cfc2d601028a1f6e31589345aedf274c816044eb35c04038d2e9ddcfd02c72a8351026a88f55d2362
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV6l:UVqoCl/YgjxEufVU0TbTyDDalEl

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2468	explorer.exe
3008	spoolsv.exe
2736	svchost.exe
812	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2468	explorer.exe
3008	spoolsv.exe
2736	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	530219f327f5e00ea04b0245bf6c1690N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	530219f327f5e00ea04b0245bf6c1690N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2672	schtasks.exe
1872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2736	svchost.exe
2736	svchost.exe
2468	explorer.exe
2736	svchost.exe
2468	explorer.exe
2736	svchost.exe
2468	explorer.exe
2736	svchost.exe
2468	explorer.exe
2736	svchost.exe
2468	explorer.exe
2736	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2468	explorer.exe
2736	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2872	530219f327f5e00ea04b0245bf6c1690N.exe
2468	explorer.exe
2468	explorer.exe
3008	spoolsv.exe
3008	spoolsv.exe
2736	svchost.exe
2736	svchost.exe
812	spoolsv.exe
812	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2468	2872	530219f327f5e00ea04b0245bf6c1690N.exe	31
PID 2872 wrote to memory of 2468	2872	530219f327f5e00ea04b0245bf6c1690N.exe	31
PID 2872 wrote to memory of 2468	2872	530219f327f5e00ea04b0245bf6c1690N.exe	31
PID 2872 wrote to memory of 2468	2872	530219f327f5e00ea04b0245bf6c1690N.exe	31
PID 2468 wrote to memory of 3008	2468	explorer.exe	32
PID 2468 wrote to memory of 3008	2468	explorer.exe	32
PID 2468 wrote to memory of 3008	2468	explorer.exe	32
PID 2468 wrote to memory of 3008	2468	explorer.exe	32
PID 3008 wrote to memory of 2736	3008	spoolsv.exe	33
PID 3008 wrote to memory of 2736	3008	spoolsv.exe	33
PID 3008 wrote to memory of 2736	3008	spoolsv.exe	33
PID 3008 wrote to memory of 2736	3008	spoolsv.exe	33
PID 2736 wrote to memory of 812	2736	svchost.exe	34
PID 2736 wrote to memory of 812	2736	svchost.exe	34
PID 2736 wrote to memory of 812	2736	svchost.exe	34
PID 2736 wrote to memory of 812	2736	svchost.exe	34
PID 2468 wrote to memory of 2836	2468	explorer.exe	35
PID 2468 wrote to memory of 2836	2468	explorer.exe	35
PID 2468 wrote to memory of 2836	2468	explorer.exe	35
PID 2468 wrote to memory of 2836	2468	explorer.exe	35
PID 2736 wrote to memory of 2672	2736	svchost.exe	36
PID 2736 wrote to memory of 2672	2736	svchost.exe	36
PID 2736 wrote to memory of 2672	2736	svchost.exe	36
PID 2736 wrote to memory of 2672	2736	svchost.exe	36
PID 2736 wrote to memory of 1872	2736	svchost.exe	39
PID 2736 wrote to memory of 1872	2736	svchost.exe	39
PID 2736 wrote to memory of 1872	2736	svchost.exe	39
PID 2736 wrote to memory of 1872	2736	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\530219f327f5e00ea04b0245bf6c1690N.exe
"C:\Users\Admin\AppData\Local\Temp\530219f327f5e00ea04b0245bf6c1690N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2468
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2736
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:812
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:03 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2672
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:04 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1872
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
827f724d3ddb1fd9f88f868f4c4818ac

SHA1
d3fb4c31c87570453c7eb530bef73f40db337140

SHA256
8c63e982228ab184633eef446670359b0113e7625473e91606a52f18b27c7593

SHA512
d5760d091cc508c134c8adbcd24ac90d80341f630de35065262b415da5a058265696c37643c88f4f592b87e1925d04f7f357adab6dae3780dc4852c3902ce012

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
26c0f4e876a02a3ec518a1e215dd8370

SHA1
7ef79cb34665da9d2fc8ac412c708d14622bae1e

SHA256
651a49a87f6953af926cb2bd077f01d3b59e6ed7a21c2f372ce441d5411b7b1a

SHA512
d80069e5227f656135adc55d93a65d3ab75560d1a3cb346bdb2c21bb384bc63f53aecd495f6163cde51a7580f493472ab2440201884d7a1beab62ce97b047784

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
33d4207d4d45f24785fa2c89d6a871d4

SHA1
6f4424dd7fb92beec515b813543e97e5501972be

SHA256
621d2297147f7d6c5e38060d7f8569ffae687af3c7815508255a99acb370e12c

SHA512
3cba55aed5daef38917a9576c2de318b986d8c51c6cf68da78c9650203be71ac36ab4249c4d18f268a36f528e8c0eb7357e415814e29e43511c24a636a6a4259

Download Submit
memory/812-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2468-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2468-44-0x0000000000510000-0x000000000052F000-memory.dmp

Filesize
124KB

Download
memory/2736-35-0x00000000002F0000-0x000000000030F000-memory.dmp

Filesize
124KB

Download
memory/2736-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2736-46-0x00000000002F0000-0x000000000030F000-memory.dmp

Filesize
124KB

Download
memory/2872-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2872-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3008-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download