Overview

overview

10

Static

static

3

0bfaf5af70...9N.exe

windows7-x64

10

0bfaf5af70...9N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 07:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0bfaf5af70b11c4ebfd913e86fe67ebc5ec01c223994a97d8117024e319787c9N.exe

  • Size

    206KB

  • MD5

    f2eca8a1384f05e2080249c0decd8e30

  • SHA1

    0a15d4edf45594070eb498baf37d4799987e4ea3

  • SHA256

    0bfaf5af70b11c4ebfd913e86fe67ebc5ec01c223994a97d8117024e319787c9

  • SHA512

    3d33aaea079a8a815fd831f7262cc52caee26592b966de315f446e5094b5cddbb29b0c05b9754c6c1c59b58236ed18b9e11fff2eca92a5486e2e989b4fe69162

  • SSDEEP

    1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdg:/VqoCl/YgjxEufVU0TbTyDDalbg

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0bfaf5af70b11c4ebfd913e86fe67ebc5ec01c223994a97d8117024e319787c9N.exe
    "C:\Users\Admin\AppData\Local\Temp\0bfaf5af70b11c4ebfd913e86fe67ebc5ec01c223994a97d8117024e319787c9N.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1228
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2184
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3320
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3536
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    206KB

    MD5

    0fc62c7e053ef0b3dd7ba9da9241ad4a

    SHA1

    e6eb3c5649d2c7c03fad30d191017d582aa0ec04

    SHA256

    33678cf9b21bf7355661fa4b45dc756a6692813242b6f62a582140112376f397

    SHA512

    3d552dabf832f00995741858ee47416d801d84ab2d6a9512b05699669265e27e8ff7061938f53f334e37e3768efd5db19b35413d5743adf7b576435152136394

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    206KB

    MD5

    8889fdfd13f19609d866bc4821f8d318

    SHA1

    a9ec0567f1c78379af28f2013ecdb0c1381eb09d

    SHA256

    dcc438ad06f32cb4c1fb215a1e5ed390c48c78f76a39756887339a6e5f94da13

    SHA512

    6a87d7eb3769ace675553adec1939d2e5359b4fafb9c1bfdacd74a49d9099a3c4a3dc97e567749abae9b74fea10e44fc8f824cd3e51288a01c5b6c05c98281bb

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    206KB

    MD5

    fdf6cf9a07ea39f4c0e4b72207addd9a

    SHA1

    ee59f663596d688f3aaf2c10502c3b18b178b47b

    SHA256

    a23edcba5b44d400b6d97ac93bfb12ffff787f44b75e9730a8dc3f7136a057d9

    SHA512

    bc1b5bd96a0baec1b2bb0faaf02d4e91784c7576c556bbc5ce1de38a4a5b96aa0d1e20398e247204fd4079522c54529f326b1bb87c8cee71b9481269a9c4ef7d

    Download Submit

  • memory/1228-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1228-34-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2184-35-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3320-33-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3396-32-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3536-36-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download