Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 19:18
Behavioral task
behavioral1
Sample
06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe
Resource
win10v2004-20241007-en
General
-
Target
06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe
-
Size
2.6MB
-
MD5
7e836a7d8467c672e61bdb89220e9d82
-
SHA1
ac43f7879f0fdc8d160654073289468e1b270eb7
-
SHA256
06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54
-
SHA512
876397e6ab0a02397c7142f4570055137a737bf66bab6311d8aa2c17fc52bb7de4b368b508ca3fbd536f11ea921f699e3d7c9483ca0fe5bb6723d1332dc58beb
-
SSDEEP
49152:ly5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/YW:ly5G4DOT5JGIVzh/5aZX0zgd0IZGpwR
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 4500 explorer.exe 1052 spoolsv.exe 3652 svchost.exe 2292 spoolsv.exe -
resource yara_rule behavioral2/memory/468-0-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/files/0x0008000000023c83-8.dat themida behavioral2/memory/4500-10-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/files/0x0008000000023c85-15.dat themida behavioral2/memory/1052-19-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/files/0x0008000000023c87-26.dat themida behavioral2/memory/3652-28-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/2292-33-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/468-42-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/1052-41-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/2292-38-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4500-43-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/3652-45-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4500-53-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4500-57-0x0000000000400000-0x0000000000A13000-memory.dmp themida behavioral2/memory/4500-67-0x0000000000400000-0x0000000000A13000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 4500 explorer.exe 1052 spoolsv.exe 3652 svchost.exe 2292 spoolsv.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4500 explorer.exe 3652 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 4500 explorer.exe 4500 explorer.exe 1052 spoolsv.exe 1052 spoolsv.exe 3652 svchost.exe 3652 svchost.exe 2292 spoolsv.exe 2292 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 468 wrote to memory of 4500 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 85 PID 468 wrote to memory of 4500 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 85 PID 468 wrote to memory of 4500 468 06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe 85 PID 4500 wrote to memory of 1052 4500 explorer.exe 87 PID 4500 wrote to memory of 1052 4500 explorer.exe 87 PID 4500 wrote to memory of 1052 4500 explorer.exe 87 PID 1052 wrote to memory of 3652 1052 spoolsv.exe 88 PID 1052 wrote to memory of 3652 1052 spoolsv.exe 88 PID 1052 wrote to memory of 3652 1052 spoolsv.exe 88 PID 3652 wrote to memory of 2292 3652 svchost.exe 89 PID 3652 wrote to memory of 2292 3652 svchost.exe 89 PID 3652 wrote to memory of 2292 3652 svchost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe"C:\Users\Admin\AppData\Local\Temp\06f1f10c7e0dffeb9ef08ed80ba8da73bfdb0aa1a90acbeca3cc5ac46c576c54.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2292
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5e0ef7489d12eb469be18bc11fcbcc08d
SHA174e1422c596a53ee384c95a3067ac1bd5146c0c9
SHA256a6e7cbed9f795b3fbdb6eb9139732f24a83cf8d2d3d32b3d8232ca2ab949ec9a
SHA51264dbe15f456683998d345cda03f6f154b39ff8ed83907cc4244ce5e1f5842da4e94c733a1d71c87c1827d798339f13edc2ab2a0897b717f9e8eaa6c8c4bf3d87
-
Filesize
2.6MB
MD5f5efa412b988ecd676bce4cb16b01f81
SHA1b497fae6ac1278faa7a0e0ff62f7dc2025ce2bc8
SHA25693ea6a8b09fecbca6638d02c4ecd7a209fd31e26d3b24263ff79e6db86c192b6
SHA512fd2c659790dc86ca463470ae357471baecd9cd95fa7beb390c45bd8c5a09bfce99b0ce63f7a9048f98c55fbccb693e608fdca5b7cae11a5047087642a6c760af
-
Filesize
2.6MB
MD57a7d28c6aae5b9512d2608df802d0e20
SHA1e056df20e754493d3ca6196125e231dd30c5956b
SHA256f33869ab0e9ba8868d74742ef752b88f052c86b5b0c68f2124ad277333558d95
SHA512aba63c5dc8f02a1e006a3c1c42a4fcd1f91e7cd8e1ca3650d02346c93eed4ed26dab645e97a5fd782524742f640674402aa76ecba814a68c373343767fa612a0