5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
Size

206KB
MD5

8a7559fb15eb0f004db41fb3a244deb0
SHA1

43dd4d6089ad0595d3e02746a5d17991ebe57f0e
SHA256

5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654
SHA512

9530caf4ddc861ff75db6696e8e53877005051ba9d324f70aa77f43fb7dbab417c31bc132dda8150f677dcb83ec45a8c788737e4b011e4ee8f4e699382bf8cb5
SSDEEP

1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdg:/VqoCl/YgjxEufVU0TbTyDDalbg

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
1888	explorer.exe
2908	spoolsv.exe
2880	svchost.exe
2704	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
1888	explorer.exe
1888	explorer.exe
2908	spoolsv.exe
2908	spoolsv.exe
2880	svchost.exe
2880	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2672	schtasks.exe
3064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
1888	explorer.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
1888	explorer.exe
2880	svchost.exe
1888	explorer.exe
1888	explorer.exe
2880	svchost.exe
1888	explorer.exe
2880	svchost.exe
1888	explorer.exe
2880	svchost.exe
2880	svchost.exe
1888	explorer.exe
1888	explorer.exe
2880	svchost.exe
1888	explorer.exe
1888	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1888	explorer.exe
2880	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
1888	explorer.exe
1888	explorer.exe
2908	spoolsv.exe
2908	spoolsv.exe
2880	svchost.exe
2880	svchost.exe
2704	spoolsv.exe
2704	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 1888	2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe	30
PID 2752 wrote to memory of 1888	2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe	30
PID 2752 wrote to memory of 1888	2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe	30
PID 2752 wrote to memory of 1888	2752	5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe	30
PID 1888 wrote to memory of 2908	1888	explorer.exe	31
PID 1888 wrote to memory of 2908	1888	explorer.exe	31
PID 1888 wrote to memory of 2908	1888	explorer.exe	31
PID 1888 wrote to memory of 2908	1888	explorer.exe	31
PID 2908 wrote to memory of 2880	2908	spoolsv.exe	32
PID 2908 wrote to memory of 2880	2908	spoolsv.exe	32
PID 2908 wrote to memory of 2880	2908	spoolsv.exe	32
PID 2908 wrote to memory of 2880	2908	spoolsv.exe	32
PID 2880 wrote to memory of 2704	2880	svchost.exe	33
PID 2880 wrote to memory of 2704	2880	svchost.exe	33
PID 2880 wrote to memory of 2704	2880	svchost.exe	33
PID 2880 wrote to memory of 2704	2880	svchost.exe	33
PID 1888 wrote to memory of 2844	1888	explorer.exe	34
PID 1888 wrote to memory of 2844	1888	explorer.exe	34
PID 1888 wrote to memory of 2844	1888	explorer.exe	34
PID 1888 wrote to memory of 2844	1888	explorer.exe	34
PID 2880 wrote to memory of 2672	2880	svchost.exe	35
PID 2880 wrote to memory of 2672	2880	svchost.exe	35
PID 2880 wrote to memory of 2672	2880	svchost.exe	35
PID 2880 wrote to memory of 2672	2880	svchost.exe	35
PID 2880 wrote to memory of 3064	2880	svchost.exe	38
PID 2880 wrote to memory of 3064	2880	svchost.exe	38
PID 2880 wrote to memory of 3064	2880	svchost.exe	38
PID 2880 wrote to memory of 3064	2880	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe
"C:\Users\Admin\AppData\Local\Temp\5f9ddf09e2b8e79792cc3a9f8f44fa058eeb29897186514061d7e4261f2aa654N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1888
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2880
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2704
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 13:57 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2672
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 13:58 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3064
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Resources\Themes\explorer.exe

Filesize
206KB

MD5
b8619571617441052509684080bfd989

SHA1
d953dbcde9ee05cac2b8acc39617284ddd512e78

SHA256
ffba3ad40a01d0e82b781adba07ad8bf56527faf6b8a5dea3a49df0eeccedf87

SHA512
1468072551dbcfc96097e0971e6b0ed4c17f107c32296cd187af1ad24ce42a3b5795a8932feb7fb6e0ff8a15c130e18b3b953dfdb5ec1fbc05e02981e964af66

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
206KB

MD5
039439880e5c280e296f6e6cb2dd9f19

SHA1
7a9c817a028e147aa408c33e280c79a418c820a1

SHA256
0833c8492922196f1906080cf1d845c0088438ddd206fb6f250c36be1276955e

SHA512
72344e72f45375dea52f406959c0c08e384d53dc09a100ad24e10fe07f106ac0aea7272fe798f03de313dbc68aa09d5f40f1650a1e4687705d0a06b6ac38d374

Download Submit
\Windows\Resources\svchost.exe

Filesize
206KB

MD5
9faa9b427c5e3d810c99dafa3fe5147e

SHA1
f17583c9ef2c1469fe6062ac334bbeff8b09dd78

SHA256
00fb41381fadd42ad25d23ff19e45ab5d83c81acc29e17ab1779d2e9b1db20ab

SHA512
ebf30b8ffa4d542a01fbfc4b9db8dde7a76d9ae3fc43144e8612baf3e370103124380cca36d56cf60dbbd699134311021b60caf4f630e8c2405bd3caa0e65214

Download Submit
memory/1888-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1888-27-0x0000000000240000-0x000000000026F000-memory.dmp

Filesize
188KB

Download
memory/1888-58-0x0000000000240000-0x000000000026F000-memory.dmp

Filesize
188KB

Download
memory/1888-59-0x0000000000240000-0x000000000026F000-memory.dmp

Filesize
188KB

Download
memory/2704-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2752-13-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download
memory/2752-14-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download
memory/2752-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2752-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2880-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2908-42-0x00000000002F0000-0x000000000031F000-memory.dmp

Filesize
188KB

Download
memory/2908-41-0x00000000002F0000-0x000000000031F000-memory.dmp

Filesize
188KB

Download
memory/2908-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download