Overview

overview

10

Static

static

3

f94705eb40...6e.exe

windows7-x64

10

f94705eb40...6e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 23:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f94705eb405d00354dc181f058349670cdf915f6b1df36096ad89ac56480956e.exe

  • Size

    135KB

  • MD5

    66243c710781c931e24bdc8cab4d3459

  • SHA1

    e0a3ee46bb2c6981dfb1cc9257f8f12b04719f22

  • SHA256

    f94705eb405d00354dc181f058349670cdf915f6b1df36096ad89ac56480956e

  • SHA512

    b7fe82eb80f562dcd46b1687dc1656674ac81cbe80501193ffa49bdc3a7478516a07f1693ffdb3ba1b6e7c2c8b6fcc8875aecc7eb2dd2c33f6bcee2596f9f5df

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV7a:UVqoCl/YgjxEufVU0TbTyDDalFa

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f94705eb405d00354dc181f058349670cdf915f6b1df36096ad89ac56480956e.exe
    "C:\Users\Admin\AppData\Local\Temp\f94705eb405d00354dc181f058349670cdf915f6b1df36096ad89ac56480956e.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3088
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4588
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5024
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2500
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    135KB

    MD5

    9a5edce40fb7887d4adb6c157d5ac513

    SHA1

    5d79dc66b86727f54cf1ad4107874bf82bec3b60

    SHA256

    0665e2ee0bbb82108e64f6133c60a1c76d9a3fa731e10b8950a9e16663f705cc

    SHA512

    1f5154198e45c9ddbcd1003de32d14d497859aaef6c45f0e509a25fe8d494cd338d35a78c6175bd0bbac7da98a66963a83fb2e73a170b3988f26193734da4d96

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    135KB

    MD5

    d7f18da07631009552913ae27b4b8bd6

    SHA1

    3fe2323fd4c0fd006a2120089667cb910647b37a

    SHA256

    c1ff83b19010da035f8df3cda12ab40501e95498c4a4090214f426731b5de6ba

    SHA512

    1e3424350bac78be6b5585a0ad3c26be02897184b1e2ec9c5f16912b2c22e123b58840277df9815bf68a4fc0f7900d830db0a30df9a7caecc4a7ab12c753cf9d

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    135KB

    MD5

    aced6cb42346678b81b915800b9f3e57

    SHA1

    3c353215c6f572a82a0f2e31ccb27aba6a4f20b8

    SHA256

    393d5cfd8d95974fc44f1e19fab3fcf4c592f524793c5befc70c6f8804e59e0a

    SHA512

    2ff5c7d22651c26b70695611b98d49ba5ddac735b178279d03aeeac62699678a320cd56cc95bc8f3b3125c144a567c55c19c92e02157a0b9faa44eb5abfdea40

    Download Submit

  • memory/2500-36-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2744-32-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3088-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3088-34-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4588-35-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/5024-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download