4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
Size

135KB
MD5

30e98fd7c6bba9e873e05819a13bfa4e
SHA1

e491f8cfe171f0d73e5a0f7506eaa8e150f812be
SHA256

4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22
SHA512

d85f191149c027ab57ff2b0f55b587cc7f28b7aadf3c6c08cfb45753c046997b5fa7a2f87723b4c008ca0e52985a38ee143d8a9d2cc650d62ebd6de29e2ea914
SSDEEP

1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVArBZ:4VqoCl/YgjxEufVU0TbTyDDalGZ

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2448	explorer.exe
2320	spoolsv.exe
2828	svchost.exe
2776	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2448	explorer.exe
2320	spoolsv.exe
2828	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2640	schtasks.exe
2332	schtasks.exe
1036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2448	explorer.exe
2448	explorer.exe
2448	explorer.exe
2828	svchost.exe
2828	svchost.exe
2448	explorer.exe
2828	svchost.exe
2448	explorer.exe
2828	svchost.exe
2448	explorer.exe
2828	svchost.exe
2448	explorer.exe
2828	svchost.exe
2448	explorer.exe
2828	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2448	explorer.exe
2828	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
2448	explorer.exe
2448	explorer.exe
2320	spoolsv.exe
2320	spoolsv.exe
2828	svchost.exe
2828	svchost.exe
2776	spoolsv.exe
2776	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2448	2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe	29
PID 2324 wrote to memory of 2448	2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe	29
PID 2324 wrote to memory of 2448	2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe	29
PID 2324 wrote to memory of 2448	2324	4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe	29
PID 2448 wrote to memory of 2320	2448	explorer.exe	30
PID 2448 wrote to memory of 2320	2448	explorer.exe	30
PID 2448 wrote to memory of 2320	2448	explorer.exe	30
PID 2448 wrote to memory of 2320	2448	explorer.exe	30
PID 2320 wrote to memory of 2828	2320	spoolsv.exe	31
PID 2320 wrote to memory of 2828	2320	spoolsv.exe	31
PID 2320 wrote to memory of 2828	2320	spoolsv.exe	31
PID 2320 wrote to memory of 2828	2320	spoolsv.exe	31
PID 2828 wrote to memory of 2776	2828	svchost.exe	32
PID 2828 wrote to memory of 2776	2828	svchost.exe	32
PID 2828 wrote to memory of 2776	2828	svchost.exe	32
PID 2828 wrote to memory of 2776	2828	svchost.exe	32
PID 2448 wrote to memory of 2928	2448	explorer.exe	33
PID 2448 wrote to memory of 2928	2448	explorer.exe	33
PID 2448 wrote to memory of 2928	2448	explorer.exe	33
PID 2448 wrote to memory of 2928	2448	explorer.exe	33
PID 2828 wrote to memory of 2640	2828	svchost.exe	34
PID 2828 wrote to memory of 2640	2828	svchost.exe	34
PID 2828 wrote to memory of 2640	2828	svchost.exe	34
PID 2828 wrote to memory of 2640	2828	svchost.exe	34
PID 2828 wrote to memory of 2332	2828	svchost.exe	37
PID 2828 wrote to memory of 2332	2828	svchost.exe	37
PID 2828 wrote to memory of 2332	2828	svchost.exe	37
PID 2828 wrote to memory of 2332	2828	svchost.exe	37
PID 2828 wrote to memory of 1036	2828	svchost.exe	39
PID 2828 wrote to memory of 1036	2828	svchost.exe	39
PID 2828 wrote to memory of 1036	2828	svchost.exe	39
PID 2828 wrote to memory of 1036	2828	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe
"C:\Users\Admin\AppData\Local\Temp\4f8ec5a23c3029ef37b05a416cf63a6c276c6ea82db3050fe31f0dd27f007e22.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2448
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2828
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2776
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:14 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2640
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:15 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2332
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:16 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1036
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
352ef92ade300f928364f824ba98155f

SHA1
aaf22a91a915dbbd2337aa7fc211e2c00d2de250

SHA256
c1af4c18e5dbb1f54f8bdfa963c5d9c8a096bf36e909e5bb836e52faf9c628ad

SHA512
899aea41b6f3b7bd43ee0aacd5501be3e56ec828b35b378227f949a3bf10506b0a1cdd64b16b6b5e0b6ae7c84d754f87e2606f6483ede3fd02573d3926580615

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
78f6c43a883fa67c49f047cb4c2cc0ff

SHA1
56c7122fecfa06e6ddf9d9edae1b6b8c5cd0e562

SHA256
21cc2b98ed42fba63b04e51e2cce93d227428fa5219cea060bc25d0cea5e946e

SHA512
24beb0576d72cb7c7846cc9a2e8657f254062795e9c5eabc6ea2e0e4ce8f1554bda8f96e7361b52a2f5419b2b357de997ce6aa20fce061c2aea82d90e10b2ec6

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
46ae053808120518394098ef3a02fa67

SHA1
22a92ff85f0f181ab627ea2c46892831aa218b78

SHA256
1d4fb25559ff2f9aa310fae33562591aa8c09dfc3ac0755c674017020064ca55

SHA512
05e6126114ffe60be38707d8c775ec3bfc81638bb9bc802f62477efa7d989eb65b86eedd96939e846030df686e2f9ba0fec65c51cf5879ebe5448f03a1a66770

Download Submit
memory/2320-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2324-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2324-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2448-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2776-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2828-35-0x0000000000280000-0x000000000029F000-memory.dmp

Filesize
124KB

Download
memory/2828-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2828-45-0x0000000000280000-0x000000000029F000-memory.dmp

Filesize
124KB

Download