24da608c67872f52cabdba9feda205d8dba2b262d2beedc24f3d72f1f559d8b0

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RippleSpoofer.exe
Size

15.8MB
MD5

35175d50551f70b05a02a9bde0cd21db
SHA1

7f18ebacb109cce92415897991562ebd5ec8df46
SHA256

24da608c67872f52cabdba9feda205d8dba2b262d2beedc24f3d72f1f559d8b0
SHA512

7f76b7d679d15faf8a259f35442f46406ea5d1e762d9cb3a9d4d2ce3c6bbe574d6e49e426757af75cc3fae0d65c98df1e0760d1ca085171325d4b0f257f32a96
SSDEEP

393216:6AiUmWQEnjaa4cqmAa4ICSSF1a0HPRV8gtFlSiZh5Zlr:9hnGhMAXSmHXFAW

Score

10^/10

discovery evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ripplespoofer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ripplespoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ripplespoofer.exe

Executes dropped EXE 7 IoCs

pid	Process
2128	ripplespoofer.exe
536	icsys.icn.exe
2872	explorer.exe
1140	Process not Found
2764	spoolsv.exe
2856	svchost.exe
2716	spoolsv.exe

Loads dropped DLL 6 IoCs

pid	Process
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
536	icsys.icn.exe
2872	explorer.exe
2764	spoolsv.exe
2856	svchost.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00080000000173f3-6.dat	themida
behavioral1/memory/2128-19-0x0000000000340000-0x0000000001FC0000-memory.dmp	themida
behavioral1/memory/2128-20-0x0000000000340000-0x0000000001FC0000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ripplespoofer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2128	ripplespoofer.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	RippleSpoofer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RippleSpoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2228	schtasks.exe
2384	schtasks.exe
2940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
536	icsys.icn.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe
2856	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2872	explorer.exe
2856	svchost.exe
2128	ripplespoofer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	ripplespoofer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2100	RippleSpoofer.exe
2100	RippleSpoofer.exe
536	icsys.icn.exe
536	icsys.icn.exe
2872	explorer.exe
2872	explorer.exe
2764	spoolsv.exe
2764	spoolsv.exe
2856	svchost.exe
2856	svchost.exe
2716	spoolsv.exe
2716	spoolsv.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2128	2100	RippleSpoofer.exe	30
PID 2100 wrote to memory of 2128	2100	RippleSpoofer.exe	30
PID 2100 wrote to memory of 2128	2100	RippleSpoofer.exe	30
PID 2100 wrote to memory of 2128	2100	RippleSpoofer.exe	30
PID 2100 wrote to memory of 536	2100	RippleSpoofer.exe	32
PID 2100 wrote to memory of 536	2100	RippleSpoofer.exe	32
PID 2100 wrote to memory of 536	2100	RippleSpoofer.exe	32
PID 2100 wrote to memory of 536	2100	RippleSpoofer.exe	32
PID 536 wrote to memory of 2872	536	icsys.icn.exe	33
PID 536 wrote to memory of 2872	536	icsys.icn.exe	33
PID 536 wrote to memory of 2872	536	icsys.icn.exe	33
PID 536 wrote to memory of 2872	536	icsys.icn.exe	33
PID 2872 wrote to memory of 2764	2872	explorer.exe	34
PID 2872 wrote to memory of 2764	2872	explorer.exe	34
PID 2872 wrote to memory of 2764	2872	explorer.exe	34
PID 2872 wrote to memory of 2764	2872	explorer.exe	34
PID 2764 wrote to memory of 2856	2764	spoolsv.exe	35
PID 2764 wrote to memory of 2856	2764	spoolsv.exe	35
PID 2764 wrote to memory of 2856	2764	spoolsv.exe	35
PID 2764 wrote to memory of 2856	2764	spoolsv.exe	35
PID 2856 wrote to memory of 2716	2856	svchost.exe	36
PID 2856 wrote to memory of 2716	2856	svchost.exe	36
PID 2856 wrote to memory of 2716	2856	svchost.exe	36
PID 2856 wrote to memory of 2716	2856	svchost.exe	36
PID 2872 wrote to memory of 2208	2872	explorer.exe	37
PID 2872 wrote to memory of 2208	2872	explorer.exe	37
PID 2872 wrote to memory of 2208	2872	explorer.exe	37
PID 2872 wrote to memory of 2208	2872	explorer.exe	37
PID 2856 wrote to memory of 2228	2856	svchost.exe	38
PID 2856 wrote to memory of 2228	2856	svchost.exe	38
PID 2856 wrote to memory of 2228	2856	svchost.exe	38
PID 2856 wrote to memory of 2228	2856	svchost.exe	38
PID 2856 wrote to memory of 2384	2856	svchost.exe	41
PID 2856 wrote to memory of 2384	2856	svchost.exe	41
PID 2856 wrote to memory of 2384	2856	svchost.exe	41
PID 2856 wrote to memory of 2384	2856	svchost.exe	41
PID 2856 wrote to memory of 2940	2856	svchost.exe	43
PID 2856 wrote to memory of 2940	2856	svchost.exe	43
PID 2856 wrote to memory of 2940	2856	svchost.exe	43
PID 2856 wrote to memory of 2940	2856	svchost.exe	43

C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- \??\c:\users\admin\appdata\local\temp\ripplespoofer.exe
  c:\users\admin\appdata\local\temp\ripplespoofer.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:536
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2764
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2856
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:39 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2228
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:40 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2384
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:41 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2940
  - - C:\Windows\Explorer.exe
      C:\Windows\Explorer.exe
      4⤵
      PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
32d20614d1e5c8c16dfc5e77de0070ee

SHA1
45250fe5d658c95d8423ed9987a72e6e097f70cd

SHA256
1e1ef9a339309a4aea22d82af382f7f433ffd1337255536067b97b6546e4267d

SHA512
f9f844b1762205fe098d0fec4816c33bfd70ddd78f4c228f65c66a2ce2829fee13dab064ff88f415a966510260b7434b4aae72e540ca3e3d8d756fffada8e7f2

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
4528c38daa6a6d02713539fe7af6006b

SHA1
af33038764a138b0352a94319a31e6c03b69ffdd

SHA256
82b00ca9a3a4be9dff240dd1805f794cb706ca5df1721d492906314752290262

SHA512
ce2198bfcff3dc199cbad45ecbae87f78acaa002276ebb94c824cf25d6b89159ac14adadb69f87389ff1dfb50d1ab87f4054a5e9e8dbbb5a93e7bd4936bcce82

Download Submit
\Users\Admin\AppData\Local\Temp\ripplespoofer.exe

Filesize
15.6MB

MD5
76ed914a265f60ff93751afe02cf35a4

SHA1
4f8ea583e5999faaec38be4c66ff4849fcf715c6

SHA256
51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b

SHA512
83135f8b040b68cafb896c4624bd66be1ae98857907b9817701d46952d4be9aaf7ad1ab3754995363bb5192fa2c669c26f526cafc6c487b061c2edcceebde6ac

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
035eb94e525dd5b40b6aa9cb683edb73

SHA1
dd7a7793daff755ae8758c25d9da9cf058d8d7ca

SHA256
25a67891b2cc77af333b63bbcde72c49329d12a59f68a429912bcb10ba5b5178

SHA512
bc4cf26b422eb306ff36559d9f26ef4ad3edebeaf9d1c1514b1e898f2496dd932d687b0e18d294ea24f4c1c9c3e94a7035723f16d1cf0de4a54c2deea14ebfa0

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
0bfe10fb50b478a036246faec22ae028

SHA1
4cec11713e9ed09a21c8eebc4a115afc7952696e

SHA256
34995da38248de3f5a2d5b68d55dd8da327ff0e84f6ba63dc648ede6d6860fb8

SHA512
6cb017e35cec4a2c65e9d8d93b02e3fcb55d11d7cb680b0b2ea66bdc687e3fabe5686a094bc6f18c3b4982b207e2b40eb20d00c9a7be6bf69ca6d26d4f66475c

Download Submit
memory/536-78-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/536-72-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2100-39-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2100-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2100-9-0x0000000002B40000-0x00000000047C0000-memory.dmp

Filesize
28.5MB

Download
memory/2100-70-0x0000000002B40000-0x00000000047C0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-12-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-84-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-23-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-15-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-13-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-20-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-14-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-79-0x000000001D610000-0x000000001D6C2000-memory.dmp

Filesize
712KB

Download
memory/2128-19-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-22-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2128-82-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-81-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-80-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-10-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-18-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2128-16-0x0000000000340000-0x0000000001FC0000-memory.dmp

Filesize
28.5MB

Download
memory/2716-71-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2764-77-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2764-74-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/2764-76-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2856-75-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2856-93-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2872-73-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2872-92-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download