Overview

overview

10

Static

static

7

9a1e8f0633...0N.exe

windows7-x64

10

9a1e8f0633...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 01:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    9a1e8f063397cdd3c26f7131bd8f5930N.exe

  • Size

    43KB

  • MD5

    9a1e8f063397cdd3c26f7131bd8f5930

  • SHA1

    c95d07b7b6461e87eef80db2b1c9002c9f0cd02c

  • SHA256

    3dbcf9b5d69b2d1a15d62da3a30d2900f94ff58c9b2366020702d8a654c6ac2a

  • SHA512

    9925ec3e753d4c533b1c3ce672db174c1fe1f15e46ef4e4fa5d1027d08fbb448b590fa9d7623421587869f7afed94af05fa24dc40395642f4595fa89507744d2

  • SSDEEP

    768:pB3Yvnl5pzqsgKnXpkoHS6KZIFhf8HuKWJI3HG+VVVH0VA5:zIvl5dKYXGB2IuPJI+K5

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a1e8f063397cdd3c26f7131bd8f5930N.exe
    "C:\Users\Admin\AppData\Local\Temp\9a1e8f063397cdd3c26f7131bd8f5930N.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3124
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2640
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3344
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:976
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1060

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\Resources\Themes\explorer.exe
          Filesize

          43KB

          MD5

          727890243e4ee91f18e441d3da4b4f9d

          SHA1

          b98d49061991eb304f47b33013f850fa9eb7c84c

          SHA256

          2dbc85ad60ce185b47edae39236ec5abff11d9163e204b29f7831b2a2f851ab7

          SHA512

          10155767a57ee2c047f5e63cffc211116bcf2e50896a319596ffde7ff18ff8f2a56a76b64de741a35301580da8712a8d11fb2db5c290005f5e6f277935270fc0

          Download Submit

        • C:\Windows\Resources\spoolsv.exe
          Filesize

          43KB

          MD5

          1daada44bf99867aec5d893088e03304

          SHA1

          3e4c8b894cdf315a2c6a79e15e4c04554f7fa8d4

          SHA256

          9ce3cb7e06df6c003cb060f56195874ab13db5af0c4d2c4d666d641fec012396

          SHA512

          e4ecc1481be7321eb0fba13cbbaaf464e92b04cdef0d885f09155054d728b9bc0b8f99508061df3ee3927dc1c172ed3eef624d2b54cd93026ccb1fec9313b5a8

          Download Submit

        • C:\Windows\Resources\svchost.exe
          Filesize

          43KB

          MD5

          06a88ea54620db8ab96b887e1e5ef4fb

          SHA1

          b823cf140f29788541537e0714865fe8b49d6e6e

          SHA256

          c96f202dc49e73f0c7b91bf9c7ba8f1bff18c98d4bae98e611b72baeb886f778

          SHA512

          598a0bd6c8cca46d50a0900c48d819f5a9d8efcc97e43e7e4d0a20216ec574d49f0dba67478b42748b732709f7d7b8cb90ee1d19121c0c816453813d98308801

          Download Submit

        • memory/976-39-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/1060-33-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2640-38-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2640-50-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/3124-0-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/3124-37-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download

        • memory/3344-35-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

          Download