f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
Size

206KB
MD5

7cdab2169c8adacb6f31f51dcda8ab10
SHA1

9e3c75e5996510d7034b6e70a1a89b4c4da803b2
SHA256

f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069
SHA512

55f052b5d5aeb86239bea59e3dc226a5a58022fa170cac15239fd47a05cfb12aab2c284656633ca26fb07e75aa5a5357fdd178d013edaac1798944b293503128
SSDEEP

1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdk:/VqoCl/YgjxEufVU0TbTyDDalbk

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2696	explorer.exe
2652	spoolsv.exe
2888	svchost.exe
2596	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
2696	explorer.exe
2696	explorer.exe
2652	spoolsv.exe
2652	spoolsv.exe
2888	svchost.exe
2888	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2372	schtasks.exe
2676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2888	svchost.exe
2696	explorer.exe
2888	svchost.exe
2696	explorer.exe
2696	explorer.exe
2888	svchost.exe
2888	svchost.exe
2696	explorer.exe
2888	svchost.exe
2696	explorer.exe
2696	explorer.exe
2888	svchost.exe
2696	explorer.exe
2888	svchost.exe
2696	explorer.exe
2888	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2696	explorer.exe
2888	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
2696	explorer.exe
2696	explorer.exe
2652	spoolsv.exe
2652	spoolsv.exe
2888	svchost.exe
2888	svchost.exe
2596	spoolsv.exe
2596	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2696	1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe	30
PID 1792 wrote to memory of 2696	1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe	30
PID 1792 wrote to memory of 2696	1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe	30
PID 1792 wrote to memory of 2696	1792	f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe	30
PID 2696 wrote to memory of 2652	2696	explorer.exe	31
PID 2696 wrote to memory of 2652	2696	explorer.exe	31
PID 2696 wrote to memory of 2652	2696	explorer.exe	31
PID 2696 wrote to memory of 2652	2696	explorer.exe	31
PID 2652 wrote to memory of 2888	2652	spoolsv.exe	32
PID 2652 wrote to memory of 2888	2652	spoolsv.exe	32
PID 2652 wrote to memory of 2888	2652	spoolsv.exe	32
PID 2652 wrote to memory of 2888	2652	spoolsv.exe	32
PID 2888 wrote to memory of 2596	2888	svchost.exe	33
PID 2888 wrote to memory of 2596	2888	svchost.exe	33
PID 2888 wrote to memory of 2596	2888	svchost.exe	33
PID 2888 wrote to memory of 2596	2888	svchost.exe	33
PID 2696 wrote to memory of 2580	2696	explorer.exe	34
PID 2696 wrote to memory of 2580	2696	explorer.exe	34
PID 2696 wrote to memory of 2580	2696	explorer.exe	34
PID 2696 wrote to memory of 2580	2696	explorer.exe	34
PID 2888 wrote to memory of 2676	2888	svchost.exe	35
PID 2888 wrote to memory of 2676	2888	svchost.exe	35
PID 2888 wrote to memory of 2676	2888	svchost.exe	35
PID 2888 wrote to memory of 2676	2888	svchost.exe	35
PID 2888 wrote to memory of 2372	2888	svchost.exe	38
PID 2888 wrote to memory of 2372	2888	svchost.exe	38
PID 2888 wrote to memory of 2372	2888	svchost.exe	38
PID 2888 wrote to memory of 2372	2888	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe
"C:\Users\Admin\AppData\Local\Temp\f95b4d39d412c1fd58d3a9c2c9be82bd7cf2820a13e63feb8556a8fa56b07069N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2888
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2596
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:24 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2676
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:25 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2372
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\resources\themes\explorer.exe

Filesize
206KB

MD5
ffc68d837428676c5fb3e0d3f4c66d30

SHA1
272aeb7b012184507a22af57b80f47f5339f3ba4

SHA256
7f199db3043d1a6c032f01c38c90320efc0bbd5f9250406e5f9aabb09d5404c0

SHA512
c3a93d476381e306f6d54c58f930418ad90aacd4613ee9bf1546acba7d55e98d1f72971550ba40d027c04903cf0d77f79286382b4111a45b8e1e023b07fa0f5c

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
206KB

MD5
3a6652c0fac69df9bc8d6085de8910aa

SHA1
fbff0b7970e6df57e57ca02e85bf6bb9a14d3c16

SHA256
82b88fcbd0102eb97fc5d9f604efe141f7be113bef0ba994fa6a678f4129ed28

SHA512
c0c27d29b49e4ae478c2ddacdbb3e62675496640036d85383207a5ed44d096ea21b7bb519eedd0a9c8e95b22b3ca268ad6be8259a6eeecc5252ef1b2bab2545e

Download Submit
\Windows\Resources\svchost.exe

Filesize
207KB

MD5
19b5163fc01220df892623aad15e6bd4

SHA1
1a302a5533127b7e87557546c01af87cbf61c083

SHA256
a5ebb88dd5bd30e3b9af66d79e900d7dae09ee5c4358977acf23d2ba1d07b9b5

SHA512
f84d798c8bcf9f59518729759e6149098e981cafc4c17b0a6b33458c6c60ca5f1788d605d4fb88fc594c627d392d864836b3780f056be18876690cf028814842

Download Submit
memory/1792-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1792-13-0x00000000005C0000-0x00000000005EF000-memory.dmp

Filesize
188KB

Download
memory/1792-53-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2596-51-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2652-52-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2696-26-0x0000000000460000-0x000000000048F000-memory.dmp

Filesize
188KB

Download
memory/2696-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2888-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download