0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0

Analysis

max time kernel
120s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
Size

2.6MB
MD5

d2d299317746466f249c1bd3770049e0
SHA1

992612fd7397e5973e138bb3c780da7abea2f3d7
SHA256

0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0
SHA512

45095e730ecebc198fd4853bdd535ed498cb0a1a6f2dc5c1852ef56d0056f343b7fd461afc9c96e571b701871f62c3f40df95b5969fe78d594066d7455441afe
SSDEEP

49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/M:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/M

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2516	explorer.exe
1292	spoolsv.exe
2788	svchost.exe
2984	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
2516	explorer.exe
1292	spoolsv.exe
2788	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs

pid	Process
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
2516	explorer.exe
1292	spoolsv.exe
2788	svchost.exe
2788	svchost.exe
2984	spoolsv.exe
2984	spoolsv.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2592	schtasks.exe
1156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
2788	svchost.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2516	explorer.exe
2788	svchost.exe
2788	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2516	explorer.exe
2788	svchost.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
2516	explorer.exe
2516	explorer.exe
2516	explorer.exe
1292	spoolsv.exe
1292	spoolsv.exe
1292	spoolsv.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2984	spoolsv.exe
2984	spoolsv.exe
2984	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2516	1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe	30
PID 1848 wrote to memory of 2516	1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe	30
PID 1848 wrote to memory of 2516	1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe	30
PID 1848 wrote to memory of 2516	1848	0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe	30
PID 2516 wrote to memory of 1292	2516	explorer.exe	31
PID 2516 wrote to memory of 1292	2516	explorer.exe	31
PID 2516 wrote to memory of 1292	2516	explorer.exe	31
PID 2516 wrote to memory of 1292	2516	explorer.exe	31
PID 1292 wrote to memory of 2788	1292	spoolsv.exe	32
PID 1292 wrote to memory of 2788	1292	spoolsv.exe	32
PID 1292 wrote to memory of 2788	1292	spoolsv.exe	32
PID 1292 wrote to memory of 2788	1292	spoolsv.exe	32
PID 2788 wrote to memory of 2984	2788	svchost.exe	33
PID 2788 wrote to memory of 2984	2788	svchost.exe	33
PID 2788 wrote to memory of 2984	2788	svchost.exe	33
PID 2788 wrote to memory of 2984	2788	svchost.exe	33
PID 2516 wrote to memory of 2800	2516	explorer.exe	34
PID 2516 wrote to memory of 2800	2516	explorer.exe	34
PID 2516 wrote to memory of 2800	2516	explorer.exe	34
PID 2516 wrote to memory of 2800	2516	explorer.exe	34
PID 2788 wrote to memory of 2592	2788	svchost.exe	35
PID 2788 wrote to memory of 2592	2788	svchost.exe	35
PID 2788 wrote to memory of 2592	2788	svchost.exe	35
PID 2788 wrote to memory of 2592	2788	svchost.exe	35
PID 2788 wrote to memory of 1156	2788	svchost.exe	39
PID 2788 wrote to memory of 1156	2788	svchost.exe	39
PID 2788 wrote to memory of 1156	2788	svchost.exe	39
PID 2788 wrote to memory of 1156	2788	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
"C:\Users\Admin\AppData\Local\Temp\0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2788
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2984
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:34 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2592
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:35 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1156
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
2.6MB

MD5
c625c603a19c4d9701c79a3a5ff04be2

SHA1
861877787df144bcdc33484e6066a1e4d2c3e055

SHA256
5ad7950ef65d1200285916f7ec4aefad572fd7829ba7569370d606b76ad1f479

SHA512
c65f8b3a097b60149dc8db86a2163158aa7e16ee78e901f7b1c4134c588be732c1dd62b4dd929ba83e8aff59370acf76848c93a04b9513f75cd8446bec064359

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
2.6MB

MD5
8a5b47c72b0a3872fb54b8ec12af2e2d

SHA1
d907abc8945ec9dcc6d520d2cb4eda4fbcf3a524

SHA256
91e9e3b57fabf7b6928ade468d9308d93773b08ddecea992d44fa87ab660a6e6

SHA512
793e0181ea35c7b7fdc6a65024ed6ecc69a6aa747301be4d84c695fcf3168a30af0416fc8883cd0a8c0877bd0a0902d33bfddd5c47a5bef8a4cad347a46a67c9

Download Submit
\Windows\Resources\svchost.exe

Filesize
2.6MB

MD5
a55471c77efdf1c040017b60669c9ae0

SHA1
fa4ba2d5643bc8faf2760674b2fc98e5d5716143

SHA256
a5691fc800477f1dafc41356d7c88713a07d7acb0309aebc4628e4d7f43f8751

SHA512
1a7de9cd2497b05d95e3606aa889927b56907f163adbcabaa4071c1bff12f3659cd1cd6505e08be90bfb30b06d8d5a3d0c6ba5727334c0a868f2e8044017f6e1

Download Submit
memory/1292-38-0x0000000004440000-0x0000000004D91000-memory.dmp

Filesize
9.3MB

Download
memory/1292-51-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/1292-35-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/1848-2-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1848-0-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/1848-52-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/1848-11-0x0000000004360000-0x0000000004CB1000-memory.dmp

Filesize
9.3MB

Download
memory/1848-44-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-54-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2516-63-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-77-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-75-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-24-0x0000000004500000-0x0000000004E51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-12-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-53-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-13-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2516-55-0x0000000004500000-0x0000000004E51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-71-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-57-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-59-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-69-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-67-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2516-65-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2788-64-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2788-66-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2788-36-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2788-68-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2788-60-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2788-70-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2788-56-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2788-72-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2788-76-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2984-50-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2984-48-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download