3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280f

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
Size

2.6MB
MD5

86d990c85f15c81131a6ed64586dcf70
SHA1

4a19397eecce203f2f9cf3dea0e3140c851eeaa9
SHA256

3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280f
SHA512

cb8beae25836e06177678aae2debf68f09f71dea567e4ed14887830461f2a2193f137b9c9c2425735ad142e340d149b9ca82034799de79a26b5d4113af0af9a7
SSDEEP

49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/+:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/+

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
5052	explorer.exe
216	spoolsv.exe
3844	svchost.exe
2256	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs

pid	Process
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
5052	explorer.exe
216	spoolsv.exe
216	spoolsv.exe
3844	svchost.exe
2256	spoolsv.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe
3844	svchost.exe
5052	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5052	explorer.exe
3844	svchost.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
5052	explorer.exe
5052	explorer.exe
5052	explorer.exe
216	spoolsv.exe
216	spoolsv.exe
216	spoolsv.exe
3844	svchost.exe
3844	svchost.exe
3844	svchost.exe
2256	spoolsv.exe
2256	spoolsv.exe
2256	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 5052	2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe	82
PID 2492 wrote to memory of 5052	2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe	82
PID 2492 wrote to memory of 5052	2492	3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe	82
PID 5052 wrote to memory of 216	5052	explorer.exe	83
PID 5052 wrote to memory of 216	5052	explorer.exe	83
PID 5052 wrote to memory of 216	5052	explorer.exe	83
PID 216 wrote to memory of 3844	216	spoolsv.exe	84
PID 216 wrote to memory of 3844	216	spoolsv.exe	84
PID 216 wrote to memory of 3844	216	spoolsv.exe	84
PID 3844 wrote to memory of 2256	3844	svchost.exe	85
PID 3844 wrote to memory of 2256	3844	svchost.exe	85
PID 3844 wrote to memory of 2256	3844	svchost.exe	85

C:\Users\Admin\AppData\Local\Temp\3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe
"C:\Users\Admin\AppData\Local\Temp\3e926e144582b99e5c4aa1f6989bd1f96fe6b37e3858174e67e1af851df1280fN.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5052
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:216
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3844
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
2.6MB

MD5
1960f73f8d57dcd8c4feb3ed7d6ee647

SHA1
8606f79ce306cbc06634bd9b304749e68c3fa60e

SHA256
b9c38ee2eafcbd0e7139497338914380a26c577fe38010f7bbe3f37da009530e

SHA512
a3cf19417621b68e273f4a0ee2dcf30f775df00bb4fd3c311d89645ed61dff52e4a3fd0d34faa6bfbfbd3745f47805e5d33594b1e4e33b77371f74ee6054bad9

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
2.6MB

MD5
4bdb2a1068710a11e1a06fab2a82193c

SHA1
82c7df8ec22995dc58dbf567b01a1ebb162b7716

SHA256
5f98ea0000d4b394d2a86cf183f50de5b1e45a79034013ad3bb1e643c49a484e

SHA512
b18185ce8cef066d2f297a33678ab12917206f7f879e13f7193c2289bd5741d17c65ef9c624f59b53db00f392c8b32d397397efeac6efadc078b508e7101ee76

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
2.6MB

MD5
4c821f7b2f39e586820b6edd9aeea1f8

SHA1
57c430a8fc7b3b4d4059051adf57f78a82aab550

SHA256
d9ff3441ad9a1e5a77d47978115609a3e1ed825c8f79e0f1e857b09ea173f080

SHA512
a01ba99adeee1790c74d5e642c511b7d88eda26d1d5230e46f21370a402c71f83b8b899b5a17178da4c0a9f9f68b97a98fc79978e221253325c46e87190e5f0e

Download Submit
memory/216-39-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/216-19-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/216-20-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/216-38-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2256-33-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2256-37-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2492-0-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2492-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/2492-41-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/2492-42-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/3844-46-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/3844-53-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/3844-67-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/3844-65-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/3844-61-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/3844-49-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/3844-57-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-54-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-52-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-43-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-56-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-50-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-58-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-60-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-48-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-64-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-10-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/5052-66-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/5052-44-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download