Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 02:26

General

  • Target

    ae8480b3d9ca1b8f3af9abcebbafd081ae53ab86fd50955a8ae43bc2b43bd0bc.exe

  • Size

    233KB

  • MD5

    699ebda3389fde874bf062f761ac329e

  • SHA1

    c80d075ddf25e6bf749ccbeddfca943d721f6df3

  • SHA256

    ae8480b3d9ca1b8f3af9abcebbafd081ae53ab86fd50955a8ae43bc2b43bd0bc

  • SHA512

    ebac09d10e25ed9f91207c64906ed3e70ef6742dcb9fe6a5d72cb51c9ed60e5519e4440ab85fea002163560aac5c8f08586ac757e1da55b31a7dc13821db33d6

  • SSDEEP

    3072:5VqoCl/YgjxEufVU0TbTyDDal6z/dAMhdF2jBCmLdjaf3k6aaICeHE:5sLqdufVUNDaAz/LLvmpjE3EaICek

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae8480b3d9ca1b8f3af9abcebbafd081ae53ab86fd50955a8ae43bc2b43bd0bc.exe
    "C:\Users\Admin\AppData\Local\Temp\ae8480b3d9ca1b8f3af9abcebbafd081ae53ab86fd50955a8ae43bc2b43bd0bc.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2628
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2680
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2768
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2732
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2808
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:28 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2972
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:29 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1472
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:30 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:944
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2656

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      233KB

      MD5

      41132f5a1a849545b630406eb6f7454d

      SHA1

      a10686da496db48a622674da7e84b45f46fd7ad7

      SHA256

      4d692bf64eb0e0b4a8cc240d71d3e45d6c124b892ff14e3255b47fc9e6b09754

      SHA512

      2d0585600ea862cc231164af4b22464a83422454904b0a22e1f419d7e4591b1cf603765044225a67bbcea0aed3ec48b669f2e8a5c3edb724f10776d37fcc7578

    • \Windows\Resources\spoolsv.exe

      Filesize

      233KB

      MD5

      9dfe87dcb8e6dc061b46abece7e108e8

      SHA1

      72b8d45cb1e25c39dbc910785bf1aa4f5df283ec

      SHA256

      8518086c4c3db214299277390e973a3a996162460c6d4ddadb90325df9f46f98

      SHA512

      ab63e192c6da71a668ebe427e44825ef55a1477caf12e202d39a9eabad090a28c44b5be831175082e91688b93b7eebc26cb6e8ec18336a6d2ab3a276ca728f73

    • \Windows\Resources\svchost.exe

      Filesize

      233KB

      MD5

      502ad6196812d11b638385bda8ce57f9

      SHA1

      446ceec2deab62f91eece05626d6a0612ae12f75

      SHA256

      6727809302aaca2f4ca5b5b511c3c0b04693828f4f03b6a10841a8af456ced9e

      SHA512

      467423fb56ac065af6c5ddc24c84160e30f93c4d1368477cc51cf14b87320a03d6abe48f8d22c06ac5039a353c20801a06242d0eab03131703e897c1fd9dfa47

    • memory/2628-0-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2628-12-0x0000000000440000-0x0000000000475000-memory.dmp

      Filesize

      212KB

    • memory/2628-52-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2680-53-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2732-54-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2768-51-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2808-50-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB