Analysis
- max time kernel
150s - max time network
19s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
18/11/2024, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe
- Size 135KB
- Sample241118-e4lbvsyfrk
- SHA256 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68
- MD5 35b6a2fbd373667f3b2df33dc1dc99c8
- SHA1 a66e09c96f17ee15dca6258932fe4840a486dbf5
- SHA512 24e6cad6c00b44f1cfc774f626d8fce1bc8d366131fccebc463ce019e08c00d3365d3a1e9a8410d15502c652b8704403a7f2f06f5bd0818aa965329784f1145c
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVPIx:UVqoCl/YgjxEufVU0TbTyDDalGx
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe - Executes dropped EXE 4 IoCs
pid Process 2596 explorer.exe 2212 spoolsv.exe 2024 svchost.exe 2964 spoolsv.exe - Loads dropped DLL 4 IoCs
pid Process 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2596 explorer.exe 2212 spoolsv.exe 2024 svchost.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2844 schtasks.exe 2340 schtasks.exe 2456 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2024 svchost.exe 2596 explorer.exe 2024 svchost.exe 2024 svchost.exe 2596 explorer.exe 2596 explorer.exe 2024 svchost.exe 2596 explorer.exe 2024 svchost.exe 2596 explorer.exe 2024 svchost.exe 2596 explorer.exe 2024 svchost.exe 2596 explorer.exe 2024 svchost.exe 2596 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2024 svchost.exe 2596 explorer.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2596 explorer.exe 2596 explorer.exe 2212 spoolsv.exe 2212 spoolsv.exe 2024 svchost.exe 2024 svchost.exe 2964 spoolsv.exe 2964 spoolsv.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2596 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 30 PID 2116 wrote to memory of 2596 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 30 PID 2116 wrote to memory of 2596 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 30 PID 2116 wrote to memory of 2596 2116 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 30 PID 2596 wrote to memory of 2212 2596 explorer.exe 31 PID 2596 wrote to memory of 2212 2596 explorer.exe 31 PID 2596 wrote to memory of 2212 2596 explorer.exe 31 PID 2596 wrote to memory of 2212 2596 explorer.exe 31 PID 2212 wrote to memory of 2024 2212 spoolsv.exe 32 PID 2212 wrote to memory of 2024 2212 spoolsv.exe 32 PID 2212 wrote to memory of 2024 2212 spoolsv.exe 32 PID 2212 wrote to memory of 2024 2212 spoolsv.exe 32 PID 2024 wrote to memory of 2964 2024 svchost.exe 33 PID 2024 wrote to memory of 2964 2024 svchost.exe 33 PID 2024 wrote to memory of 2964 2024 svchost.exe 33 PID 2024 wrote to memory of 2964 2024 svchost.exe 33 PID 2596 wrote to memory of 2304 2596 explorer.exe 34 PID 2596 wrote to memory of 2304 2596 explorer.exe 34 PID 2596 wrote to memory of 2304 2596 explorer.exe 34 PID 2596 wrote to memory of 2304 2596 explorer.exe 34 PID 2024 wrote to memory of 2844 2024 svchost.exe 35 PID 2024 wrote to memory of 2844 2024 svchost.exe 35 PID 2024 wrote to memory of 2844 2024 svchost.exe 35 PID 2024 wrote to memory of 2844 2024 svchost.exe 35 PID 2024 wrote to memory of 2340 2024 svchost.exe 38 PID 2024 wrote to memory of 2340 2024 svchost.exe 38 PID 2024 wrote to memory of 2340 2024 svchost.exe 38 PID 2024 wrote to memory of 2340 2024 svchost.exe 38 PID 2024 wrote to memory of 2456 2024 svchost.exe 41 PID 2024 wrote to memory of 2456 2024 svchost.exe 41 PID 2024 wrote to memory of 2456 2024 svchost.exe 41 PID 2024 wrote to memory of 2456 2024 svchost.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe"C:\Users\Admin\AppData\Local\Temp\ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2964
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:31 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2844
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:32 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2340
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:33 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2456
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2304
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 2a8fb71246ea0d1ffe5293b1e61425621657dc3995e761b8b8407c4a04c8336f
- MD5 37c7fcd922b338f513c1a9e542f24ed6
- SHA1 cbb00613cc3930d0552fe45d198c6c868273c897
- SHA512 535c8ec6ec9c61608c6cd9b8b7fe79e3776a80c2b3c708f3edaa041ed442dcc09deb2074d9849e7c6cd56e02760ac9eea1a365ee0a13ec8986d0ea265c5e61b4
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVPIv:UVqoCl/YgjxEufVU0TbTyDDalGv
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 dec03c97213978a8a6c5322ee1ccef91a7a7942c8d3f873d80aa56940e258d7a
- MD5 df06119e8d9a866871e67372580f8912
- SHA1 b24ce71414dd6ab760a2bdcbb68374775f55dcc6
- SHA512 1847b1d5ce078cad8d1587b8c14cbfdf01cf883fa1e29c47c2957d009deddbeade11284eb7f9db34bcdcdc3400d294ce2a83dde5227ce95905eabe189c1d9b04
- SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalGI444444444444444444444444444444444444Z:UsLqdufVUNDaV444444444444444444J
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Resources\svchost.exe
- Size 135KB
- SHA256 d36ab0d430d591641ad405f1499a84d0254864aa74e6c67e2830da213ec6cc48
- MD5 6b710b4191151e72b42684f96de5036c
- SHA1 7d86e2c19b3ccea5d4b446741b2ff5d0207cf52d
- SHA512 b783fefc18bba714b3b8631cfd3f36fa93bac9b22b66f1cfaba40365c1881e4ca7cb9ce10c6448e1c99d34456d115ad3ca3ab31e3b0689edfee1839e8a31f2c3
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVPIw:UVqoCl/YgjxEufVU0TbTyDDalGw
- MD5 SHA1 SHA512 SSDEEP