Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/11/2024, 08:24

General

  • Target

    af9a08fb790c568b6e8ad8357f2fa1febdf9b7267d7720ea2e51576d2bd7ba94.exe

  • Size

    135KB

  • MD5

    9e744e9c8c56ca5749f11d3421172049

  • SHA1

    94368a884542dfd78c9d2802415ad94cfb083e8a

  • SHA256

    af9a08fb790c568b6e8ad8357f2fa1febdf9b7267d7720ea2e51576d2bd7ba94

  • SHA512

    d628f6cad788ebe7e8960cfb4fc3be74870b90671bb486fed0aa098e815806ab2b6dd81e9998550eca95454b1e7c908bbfe77ba06bd7cde860d84777bfed9eb3

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVmY:UVqoCl/YgjxEufVU0TbTyDDalQY

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af9a08fb790c568b6e8ad8357f2fa1febdf9b7267d7720ea2e51576d2bd7ba94.exe
    "C:\Users\Admin\AppData\Local\Temp\af9a08fb790c568b6e8ad8357f2fa1febdf9b7267d7720ea2e51576d2bd7ba94.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1868
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1992
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2076
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2140
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2748
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 08:26 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2828
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 08:27 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2016
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 08:28 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1188
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2660

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\Resources\spoolsv.exe

            Filesize

            135KB

            MD5

            bbc9de349fca53405c501a1e18b14e72

            SHA1

            828680086341e04ef301a06c57a7c411fb1f2b70

            SHA256

            f5c3600ec8eddafbd50dcfab4f231faefd08c714af72e316d92c74c819b8360f

            SHA512

            2e64e1a7189af73c2d2b166ae5d2a59d626af89d2a1e939ff09674043a1e7e2b091054bedc301547bef458ee010ca116a757cb8206b301191f6e6d79c3308291

          • \Windows\Resources\Themes\explorer.exe

            Filesize

            135KB

            MD5

            6eea316962b66e53374f20901a805ab1

            SHA1

            0d7417183dd7296dc84b78c6da765bdeee0f867d

            SHA256

            ec43e30fe75683cb89c93af8383ddc8b1f5f7f5bc30c8bcde71bc69b41462bf8

            SHA512

            78d12ecc876695861bf1ac466c81bceeb58b6b2b6cbd35ada9b30f94e4c5dcba83ccba0511b9c4c0e4fc43b4501627d8e161d47e7ecbb94f06b95a81e098dc0c

          • \Windows\Resources\svchost.exe

            Filesize

            135KB

            MD5

            c70154edb4ee2ae06e036e182c39f310

            SHA1

            85b0e4da7d16a9475d9f3deb993a3fcacc200526

            SHA256

            449585f0c8272348a0708621bcf554e371ab15aed5e1974f96d47252c349ac5b

            SHA512

            7432dabb119b5adf584590974ead186d02fa75641a31139901cdc2db14c7af5224d8746e9f17d5a077e11f27e06ec78bf8042d0de96e943dd9248e21639f9588

          • memory/1868-0-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/1868-42-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/1992-43-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/2076-41-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/2140-35-0x00000000002D0000-0x00000000002EF000-memory.dmp

            Filesize

            124KB

          • memory/2140-44-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/2748-40-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB