33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8a

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 00:02 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
Size

206KB
MD5

caa5d030fce8e086b1f92ad8f2081d40
SHA1

b77999baa2f166c1f07894fdc1fc8a96d3c4ef81
SHA256

33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8a
SHA512

f824f6f1ee86943b8e0c9c170146410626d1b0eb071b682fe92bbbd07b05abad668238354b0fac33cb19ffc078921ff0abe0824b267d1b443a870961829c5d07
SSDEEP

1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJd2:/VqoCl/YgjxEufVU0TbTyDDalb2

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1540	explorer.exe
5092	spoolsv.exe
5024	svchost.exe
3628	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1540	explorer.exe
5024	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
1540	explorer.exe
1540	explorer.exe
5092	spoolsv.exe
5092	spoolsv.exe
5024	svchost.exe
5024	svchost.exe
3628	spoolsv.exe
3628	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 1540	5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe	82
PID 5112 wrote to memory of 1540	5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe	82
PID 5112 wrote to memory of 1540	5112	33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe	82
PID 1540 wrote to memory of 5092	1540	explorer.exe	83
PID 1540 wrote to memory of 5092	1540	explorer.exe	83
PID 1540 wrote to memory of 5092	1540	explorer.exe	83
PID 5092 wrote to memory of 5024	5092	spoolsv.exe	84
PID 5092 wrote to memory of 5024	5092	spoolsv.exe	84
PID 5092 wrote to memory of 5024	5092	spoolsv.exe	84
PID 5024 wrote to memory of 3628	5024	svchost.exe	85
PID 5024 wrote to memory of 3628	5024	svchost.exe	85
PID 5024 wrote to memory of 3628	5024	svchost.exe	85

C:\Users\Admin\AppData\Local\Temp\33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe
"C:\Users\Admin\AppData\Local\Temp\33ccd86213fe370b911cb18788858ccf4652316ded94699b41a8a3059196ff8aN.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1540
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5024
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3628

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

209.205.72.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.205.72.20.in-addr.arpa

IN PTR

Response
DNS

0.204.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.204.248.87.in-addr.arpa

IN PTR

Response

0.204.248.87.in-addr.arpa

IN PTR

https-87-248-204-0lhrllnwnet
DNS

64.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

154.239.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.239.44.20.in-addr.arpa

IN PTR

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

79.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.190.18.2.in-addr.arpa

IN PTR

Response

79.190.18.2.in-addr.arpa

IN PTR

a2-18-190-79deploystaticakamaitechnologiescom
DNS

77.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

77.190.18.2.in-addr.arpa

IN PTR

Response

77.190.18.2.in-addr.arpa

IN PTR

a2-18-190-77deploystaticakamaitechnologiescom
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

209.205.72.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

209.205.72.20.in-addr.arpa
8.8.8.8:53

0.204.248.87.in-addr.arpa

dns

71 B
116 B
1
1

DNS Request

0.204.248.87.in-addr.arpa
8.8.8.8:53

64.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

64.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

154.239.44.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

154.239.44.20.in-addr.arpa
8.8.8.8:53

50.23.12.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

50.23.12.20.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

79.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

79.190.18.2.in-addr.arpa
8.8.8.8:53

77.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

77.190.18.2.in-addr.arpa
8.8.8.8:53

19.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
206KB

MD5
ee2f43df173fdf2a1f9477ba012368a9

SHA1
6406b81bc4a2c35f1169aa4be2390874c6a4b038

SHA256
c6b0b527c2d4b9429018721e499824e2370eefe0fba6a6e10623f32d7fbd3c3c

SHA512
9e304a8c5ea6b402acdc7de0c775e9eb97a2949b7358736ad4d06d2714eab752b26b5e5bb71cbbe20ff905fd25b5984dcd976eb4e9832c2cb45d4e838442a793

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
206KB

MD5
ee1bf8382672e9a8a8cc74b19eb8142f

SHA1
3f318c8326e5ec93b2e764af53fd819e4875ee0b

SHA256
de87d782fc35c9fbaa7b012e9f9dc53119f7ca855e36ed5d5ae6f55190d3b1b9

SHA512
d786977b167561366778df7ec3dade7d644893adb0ff22a8951248e58a3a8cbe7d6fabc98a5dcc8fccf992067807bbd0d095aa8e7e5be77a95de9c4d8b4334b5

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
206KB

MD5
008c4bebe93836f4a56119ea8d2cad0b

SHA1
808046e0af4c5e5131d741b1fd0d11e25cea28d1

SHA256
42d7220ad812cfb792847fcbf4df1f65301ed80754375f69038f591de802756c

SHA512
aa115f619fbfdf9f52c02faca8836f7efd273b6e9467b943538b453fa527dde6e5b4b6913086d083a57c73fa42958004c1da43fa499eae78b1d19038ebbb42ee

Download Submit
memory/1540-35-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3628-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5024-36-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5092-33-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5112-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5112-34-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.