f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
Size

1.0MB
MD5

83b1a127f807255e01aff7d24928c6b5
SHA1

ac8ca2d017626803af66fd050cbd184b3d69a85a
SHA256

f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47
SHA512

c7827db81ca17f664356f8755be0292bff156b36f88197ed7a57217d07d3439f8e6c831dc4ca2a94dbb34f275ed27d7ce3d880fa2af146b4368a4ae30fe295ad
SSDEEP

24576:PFOaJGzl9+a4Ne1nEFI56xU+0IdY2Zv952uetfbFEzP4UFhO5L:tN+tOWnEFZR0El0JEzQAh8

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 6 IoCs

pid	Process
1928	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2172	icsys.icn.exe
2496	explorer.exe
2732	spoolsv.exe
2744	svchost.exe
2864	spoolsv.exe

Loads dropped DLL 6 IoCs

pid	Process
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2172	icsys.icn.exe
2496	explorer.exe
2732	spoolsv.exe
2744	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1552	schtasks.exe
3032	schtasks.exe
2876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2496	explorer.exe
2744	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1928	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
1928	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
2172	icsys.icn.exe
2172	icsys.icn.exe
2496	explorer.exe
2496	explorer.exe
2732	spoolsv.exe
2732	spoolsv.exe
2744	svchost.exe
2744	svchost.exe
2864	spoolsv.exe
2864	spoolsv.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1928	2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe	30
PID 2528 wrote to memory of 1928	2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe	30
PID 2528 wrote to memory of 1928	2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe	30
PID 2528 wrote to memory of 1928	2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe	30
PID 2528 wrote to memory of 2172	2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe	31
PID 2528 wrote to memory of 2172	2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe	31
PID 2528 wrote to memory of 2172	2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe	31
PID 2528 wrote to memory of 2172	2528	f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe	31
PID 2172 wrote to memory of 2496	2172	icsys.icn.exe	32
PID 2172 wrote to memory of 2496	2172	icsys.icn.exe	32
PID 2172 wrote to memory of 2496	2172	icsys.icn.exe	32
PID 2172 wrote to memory of 2496	2172	icsys.icn.exe	32
PID 2496 wrote to memory of 2732	2496	explorer.exe	34
PID 2496 wrote to memory of 2732	2496	explorer.exe	34
PID 2496 wrote to memory of 2732	2496	explorer.exe	34
PID 2496 wrote to memory of 2732	2496	explorer.exe	34
PID 2732 wrote to memory of 2744	2732	spoolsv.exe	35
PID 2732 wrote to memory of 2744	2732	spoolsv.exe	35
PID 2732 wrote to memory of 2744	2732	spoolsv.exe	35
PID 2732 wrote to memory of 2744	2732	spoolsv.exe	35
PID 2744 wrote to memory of 2864	2744	svchost.exe	36
PID 2744 wrote to memory of 2864	2744	svchost.exe	36
PID 2744 wrote to memory of 2864	2744	svchost.exe	36
PID 2744 wrote to memory of 2864	2744	svchost.exe	36
PID 2496 wrote to memory of 2612	2496	explorer.exe	37
PID 2496 wrote to memory of 2612	2496	explorer.exe	37
PID 2496 wrote to memory of 2612	2496	explorer.exe	37
PID 2496 wrote to memory of 2612	2496	explorer.exe	37
PID 2744 wrote to memory of 2876	2744	svchost.exe	38
PID 2744 wrote to memory of 2876	2744	svchost.exe	38
PID 2744 wrote to memory of 2876	2744	svchost.exe	38
PID 2744 wrote to memory of 2876	2744	svchost.exe	38
PID 2744 wrote to memory of 1552	2744	svchost.exe	41
PID 2744 wrote to memory of 1552	2744	svchost.exe	41
PID 2744 wrote to memory of 1552	2744	svchost.exe	41
PID 2744 wrote to memory of 1552	2744	svchost.exe	41
PID 2744 wrote to memory of 3032	2744	svchost.exe	43
PID 2744 wrote to memory of 3032	2744	svchost.exe	43
PID 2744 wrote to memory of 3032	2744	svchost.exe	43
PID 2744 wrote to memory of 3032	2744	svchost.exe	43

C:\Users\Admin\AppData\Local\Temp\f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
"C:\Users\Admin\AppData\Local\Temp\f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- \??\c:\users\admin\appdata\local\temp\f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
  c:\users\admin\appdata\local\temp\f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1928
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2172
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2732
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2744
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:21 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2876
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:22 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1552
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:23 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3032
  - - C:\Windows\Explorer.exe
      C:\Windows\Explorer.exe
      4⤵
      PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
c1f7b49a86f424a2921010e94ba7006a

SHA1
702d6734fac0afd492355e313af6a6f906c9dc09

SHA256
1da690ecc527be0395146432e56b654b8b5e307526a788ff8a08855bd1657ea8

SHA512
8e4fb47c5733f314172ec882d1cf8413ff70edbcfa6284b9b0fca36369fadf3ed00f4ffe27565ea38e5fbf3bfb74bda9651b54dc00e0bb45dd51b4804b6ed9f7

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
51c92a2f72baf3aba5579092d1dac2e4

SHA1
a585908e9a05d29bd43914a6ededd11c8f5d9d65

SHA256
20e58b028dcd3f797f6784b6da8042777a965f301355a77ba43f755e72b5300e

SHA512
6f08110dbbc436adff94ce093beeefd0eb653d8b1d13d267723eeefa9399ebd1fd0f2580fadc6866f7e5090afe532cc5642a4a91e92665c9d1fff8d04eff4807

Download Submit
\Users\Admin\AppData\Local\Temp\f2fdaaf6c00ff28f3ce238048a3f52ac72cc241c23c14e0d69ab5ff4d4ff0b47.exe

Filesize
892KB

MD5
90ecaa0418237a2b6566842a36fd76d8

SHA1
a9f746b5c6fadfd031e07a0041576358f79d1a4b

SHA256
fb1e8402ed0d7b2f5dde71a0ff1cb3a3468ca35e8081f3c246f7a2128fd68c64

SHA512
8927fdb7123ccd2d120f187939474d383bc10a8be5fa86c479882b1951b8b5aef95c519fc9eef35109380c7425aa2524a38c53e2af2016d9baeeeec1a2416d17

Download Submit
\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
812cd3bea56ef98b1cc92c9098973fba

SHA1
44fdf6af12e75a6962aaa8b8e5a6593de5d402bf

SHA256
4c592109c967104b1584762476301dc94cb18bd3e00a4a839cc775bb9f16e1fa

SHA512
df5fd5aca51b7852a2c773d1e588c3177e86e710c947a8aa7d0cbdbb3ab5e5dcc6b6a714569eafc57336cd604e9138329a371cd071bad9171f215e1b990a84d9

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
45586243df1e015db4f1b56f8d5971a4

SHA1
404b841f9d9cc4bda58af408e823a163150c2a5c

SHA256
6327575c06db8072482377035fa6ca3ed2190e7630a522a1624afe1fc9c9a437

SHA512
9011f2cacaf106cd287890fe3bf3d7ffe72bc6179945c3782d923b24971c6f2a0ef3ff8269f7ed5d68770273e13fc963c18178de5ec77d8ee58b8bd10dab73e5

Download Submit
memory/2172-58-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2172-23-0x0000000000470000-0x000000000048F000-memory.dmp

Filesize
124KB

Download
memory/2496-59-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2528-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2528-57-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2732-45-0x0000000000330000-0x000000000034F000-memory.dmp

Filesize
124KB

Download
memory/2732-56-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2744-60-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2864-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download