Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/11/2024, 08:32

General

  • Target

    b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e.exe

  • Size

    45KB

  • MD5

    7e31ad528b1973d37e042032eabeed55

  • SHA1

    2b4202d461a20336791aadf7c87ce70e605b2235

  • SHA256

    b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e

  • SHA512

    6f655179b0791921637ca2ee485287e2a85baa2ca1fb5d32456f5708964c5a2a74c091cde17a1912868bcc6d8d36f72b40a78ad48439ce1fb7f5746d482aa56d

  • SSDEEP

    768:E1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JX1:EOxyeFo6NPCAosxYyXdF5oy3VoK1

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 21 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 28 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e.exe
    "C:\Users\Admin\AppData\Local\Temp\b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\recycled\SVCHOST.EXE
        C:\recycled\SVCHOST.EXE :agent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2736
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\recycled\SVCHOST.EXE
          C:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2312
        • F:\recycled\SVCHOST.EXE
          F:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2916
        • C:\recycled\SPOOLSV.EXE
          C:\recycled\SPOOLSV.EXE :agent
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1980
          • C:\recycled\SVCHOST.EXE
            C:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2604
          • F:\recycled\SVCHOST.EXE
            F:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2680
          • C:\recycled\SPOOLSV.EXE
            C:\recycled\SPOOLSV.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2332
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1108
      • C:\Windows\SysWOW64\userinit.exe
        C:\Windows\system32\userinit.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\SysWOW64\Explorer.exe
          Explorer.exe "C:\recycled\SVCHOST.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1896
    • F:\recycled\SVCHOST.EXE
      F:\recycled\SVCHOST.EXE :agent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2564
    • C:\recycled\SPOOLSV.EXE
      C:\recycled\SPOOLSV.EXE :agent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2820
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e.doc"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1988
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
        PID:1432

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Recycled\desktop.ini

              Filesize

              65B

              MD5

              ad0b0b4416f06af436328a3c12dc491b

              SHA1

              743c7ad130780de78ccbf75aa6f84298720ad3fa

              SHA256

              23521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416

              SHA512

              884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56

            • C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

              Filesize

              1KB

              MD5

              0269b6347e473980c5378044ac67aa1f

              SHA1

              c3334de50e320ad8bce8398acff95c363d039245

              SHA256

              68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

              SHA512

              e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

            • C:\begolu.txt

              Filesize

              2B

              MD5

              2b9d4fa85c8e82132bde46b143040142

              SHA1

              a02431cf7c501a5b368c91e41283419d8fa9fb03

              SHA256

              4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142

              SHA512

              c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be

            • F:\Recycled\SVCHOST.EXE

              Filesize

              45KB

              MD5

              1b07795f006bc30deffc46ea42308fc8

              SHA1

              f468797e9c1dc664d868389ae07dd16e5c02110b

              SHA256

              9f362d37e12aceee3234f09b6819ff1554e46e0552df39f50b07b158ad436cb7

              SHA512

              d320c2511fda706885a5a274a52b3dd73c81e2bc8f87b0b1de5e146a8981b21f426ca269fa74d401d71b0ff41cb5836a4432bb857b601f78ff13e2e085c45c0a

            • \Recycled\SPOOLSV.EXE

              Filesize

              45KB

              MD5

              02cf194c8a5c5d42feba4290fa25770d

              SHA1

              23ecff4101bf855b19c154dba8217590a47f6c1e

              SHA256

              abb3ff529c29ccb83e6919701e4248dadf8597e1106ea7fbe2871dbcec2ad07a

              SHA512

              7471199a8f7bb1f7f6ebb812573e98e17c3fcf61b0098c6d4b7f55d013e3e6f1756c9719a5b5a8c1566820e7c3adefacb19d36b4c6e0559b15cb9d161324bb21

            • \Recycled\SVCHOST.EXE

              Filesize

              45KB

              MD5

              1ef33fe05131f9a92875b7d8b240580a

              SHA1

              9049fe32c791b0229581db3a82f29a3e02c8c5c8

              SHA256

              47e54753d47b99f5ff7ffc8a7ed6cffdef95421ab9c3f777fc1c22fb33e193b1

              SHA512

              c9322e2189b6306a677169d31ed8bccddf897df2bf838adc6edeaebfa15496d56ab44d9c078f1ead1370b9c15cdcb9a8ab51b37133432f33cf785d5af5c750a9

            • memory/1108-96-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/1108-93-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/1980-177-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/1980-178-0x00000000003D0000-0x00000000003EA000-memory.dmp

              Filesize

              104KB

            • memory/1980-182-0x00000000003D0000-0x00000000003EA000-memory.dmp

              Filesize

              104KB

            • memory/1980-82-0x00000000003D0000-0x00000000003EA000-memory.dmp

              Filesize

              104KB

            • memory/1980-79-0x00000000003D0000-0x00000000003EA000-memory.dmp

              Filesize

              104KB

            • memory/1980-62-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2096-107-0x0000000004760000-0x000000000476C000-memory.dmp

              Filesize

              48KB

            • memory/2096-0-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2096-23-0x0000000003960000-0x000000000397A000-memory.dmp

              Filesize

              104KB

            • memory/2096-22-0x0000000003960000-0x000000000397A000-memory.dmp

              Filesize

              104KB

            • memory/2096-108-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2312-51-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2332-89-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2364-110-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/2528-24-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2528-164-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2564-103-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2604-78-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2604-70-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2680-80-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2680-83-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2736-35-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2736-32-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2820-106-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2892-47-0x00000000004E0000-0x00000000004FA000-memory.dmp

              Filesize

              104KB

            • memory/2892-168-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2892-176-0x00000000004E0000-0x00000000004FA000-memory.dmp

              Filesize

              104KB

            • memory/2892-59-0x00000000004E0000-0x00000000004FA000-memory.dmp

              Filesize

              104KB

            • memory/2892-40-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/2916-56-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB