Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 08:32

General

  • Target

    b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e.exe

  • Size

    45KB

  • MD5

    7e31ad528b1973d37e042032eabeed55

  • SHA1

    2b4202d461a20336791aadf7c87ce70e605b2235

  • SHA256

    b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e

  • SHA512

    6f655179b0791921637ca2ee485287e2a85baa2ca1fb5d32456f5708964c5a2a74c091cde17a1912868bcc6d8d36f72b40a78ad48439ce1fb7f5746d482aa56d

  • SSDEEP

    768:E1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JX1:EOxyeFo6NPCAosxYyXdF5oy3VoK1

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 29 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e.exe
    "C:\Users\Admin\AppData\Local\Temp\b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\recycled\SVCHOST.EXE
        C:\recycled\SVCHOST.EXE :agent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2548
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1216
        • C:\recycled\SVCHOST.EXE
          C:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:320
        • F:\recycled\SVCHOST.EXE
          F:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:736
        • C:\recycled\SPOOLSV.EXE
          C:\recycled\SPOOLSV.EXE :agent
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1052
          • C:\recycled\SVCHOST.EXE
            C:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3056
          • F:\recycled\SVCHOST.EXE
            F:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3300
          • C:\recycled\SPOOLSV.EXE
            C:\recycled\SPOOLSV.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4644
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1844
      • C:\Windows\SysWOW64\userinit.exe
        C:\Windows\system32\userinit.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4760
        • C:\Windows\SysWOW64\Explorer.exe
          Explorer.exe "C:\recycled\SVCHOST.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3044
    • F:\recycled\SVCHOST.EXE
      F:\recycled\SVCHOST.EXE :agent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3384
    • C:\recycled\SPOOLSV.EXE
      C:\recycled\SPOOLSV.EXE :agent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2960
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b3e23b2320be3dd7cdb52adebc1994250d7e5bbf7fa92d0e4b98141654e7070e.doc" /o ""
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4244
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
      PID:2824

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Recycled\SPOOLSV.EXE

            Filesize

            45KB

            MD5

            73245931ac95aaace1168bbfc943830f

            SHA1

            1321389d467c034a7bf7adf9d1fde6a5601e05b8

            SHA256

            16b07171633b79e315654b0f7c3c9692f984a4cd5f06a03948a2d71d1ce3981c

            SHA512

            100056c247b8332868875b1e6f869341c46f6f2cc8ed1905216795adf1115ab3916b8872b6358b7cfd672feb40cecf9699345d54e1bf9a78c9590cd6ee107ae7

          • C:\Recycled\SVCHOST.EXE

            Filesize

            45KB

            MD5

            7d5bc6e1aac6191214fdd38ccbbc3566

            SHA1

            c7f085ecd5c8f9d3a4213b3b7396bacbad5afc13

            SHA256

            bb2350a7c50fc510c5504653bf5eeeb1eb7cc123efd0bc89c3f4aa52515063df

            SHA512

            fa22625b2831cc69b4a4142306bc3a9de91f06a020389e63ba79a45db053fdc4f4e26d31e4481775b78c21ca268229ae9c3c3f7f1456cccc383737093228ef73

          • C:\Recycled\desktop.ini

            Filesize

            65B

            MD5

            ad0b0b4416f06af436328a3c12dc491b

            SHA1

            743c7ad130780de78ccbf75aa6f84298720ad3fa

            SHA256

            23521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416

            SHA512

            884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56

          • C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

            Filesize

            1KB

            MD5

            0269b6347e473980c5378044ac67aa1f

            SHA1

            c3334de50e320ad8bce8398acff95c363d039245

            SHA256

            68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

            SHA512

            e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

          • C:\Users\Admin\AppData\Local\Temp\TCD94.tmp\sist02.xsl

            Filesize

            245KB

            MD5

            f883b260a8d67082ea895c14bf56dd56

            SHA1

            7954565c1f243d46ad3b1e2f1baf3281451fc14b

            SHA256

            ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

            SHA512

            d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

          • C:\begolu.txt

            Filesize

            2B

            MD5

            2b9d4fa85c8e82132bde46b143040142

            SHA1

            a02431cf7c501a5b368c91e41283419d8fa9fb03

            SHA256

            4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142

            SHA512

            c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be

          • F:\Recycled\SVCHOST.EXE

            Filesize

            45KB

            MD5

            36f9f47e33492c80a28858ef1d599e91

            SHA1

            a5dde8b82852194cf38fa341455e1c936b2de12f

            SHA256

            71831469a233d4b9337438a53ee21cb917a269d0a657d0b86d5664611006c490

            SHA512

            ae4d35b0cf32bbf7525c0ba425f00015b9d6349a9f9bcd91149554e06938e70144ea30ccb249aa95258c8e3b25fb4ff56f7777f69d3917564dca1c49e0c7a64c

          • memory/320-39-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/736-40-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/736-43-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/1052-661-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/1052-46-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/1216-30-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/1216-654-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/1844-68-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/1844-67-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/2548-29-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/2816-0-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/2816-80-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/2960-77-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/3056-56-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/3300-60-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/3384-72-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/3384-74-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/4244-82-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

            Filesize

            64KB

          • memory/4244-84-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

            Filesize

            64KB

          • memory/4244-83-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

            Filesize

            64KB

          • memory/4244-85-0x00007FFED2800000-0x00007FFED2810000-memory.dmp

            Filesize

            64KB

          • memory/4244-86-0x00007FFED2800000-0x00007FFED2810000-memory.dmp

            Filesize

            64KB

          • memory/4244-81-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

            Filesize

            64KB

          • memory/4244-79-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

            Filesize

            64KB

          • memory/4644-63-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/5024-653-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB

          • memory/5024-18-0x0000000000400000-0x000000000041A000-memory.dmp

            Filesize

            104KB