Analysis
- max time kernel
150s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/11/2024, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe
- Size 135KB
- Sample241118-e4lbvsyfrk
- SHA256 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68
- MD5 35b6a2fbd373667f3b2df33dc1dc99c8
- SHA1 a66e09c96f17ee15dca6258932fe4840a486dbf5
- SHA512 24e6cad6c00b44f1cfc774f626d8fce1bc8d366131fccebc463ce019e08c00d3365d3a1e9a8410d15502c652b8704403a7f2f06f5bd0818aa965329784f1145c
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVPIx:UVqoCl/YgjxEufVU0TbTyDDalGx
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 2020 explorer.exe 4400 spoolsv.exe 848 svchost.exe 2008 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2020 explorer.exe 848 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 2020 explorer.exe 2020 explorer.exe 4400 spoolsv.exe 4400 spoolsv.exe 848 svchost.exe 848 svchost.exe 2008 spoolsv.exe 2008 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2020 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 83 PID 2696 wrote to memory of 2020 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 83 PID 2696 wrote to memory of 2020 2696 ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe 83 PID 2020 wrote to memory of 4400 2020 explorer.exe 85 PID 2020 wrote to memory of 4400 2020 explorer.exe 85 PID 2020 wrote to memory of 4400 2020 explorer.exe 85 PID 4400 wrote to memory of 848 4400 spoolsv.exe 86 PID 4400 wrote to memory of 848 4400 spoolsv.exe 86 PID 4400 wrote to memory of 848 4400 spoolsv.exe 86 PID 848 wrote to memory of 2008 848 svchost.exe 87 PID 848 wrote to memory of 2008 848 svchost.exe 87 PID 848 wrote to memory of 2008 848 svchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe"C:\Users\Admin\AppData\Local\Temp\ba4dd1f8f89a3d4d2b1658a944b209f4f22b8a681789a88a457913159cea7a68.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 9f2de81851f5c4b6bd9d418f3fbcc8e971029e3db6d82656448d8f21aeb2dd8e
- MD5 1d65ce3356cd1849410d215a77c3c80c
- SHA1 bec8c2df24a7a9c5054c38c5a13b156d5fac1e81
- SHA512 b55e42c537c8ce450710a1cb8e81a6858cd5c4a699bb8be07538241797d54524c44a2b69c62ddbbd2f21a692db01c6231ab79bfcf49b17d8243c804fb56f2692
- SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalGyUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUT:UsLqdufVUNDad
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 2262efef6052ad685acdfc54be5f3dd99fb38548dd65b1c182b822f995a03ff7
- MD5 a343f4f0f094f5a0e4ccd9953852d08d
- SHA1 d55681b9023c345cfa41ce5566c20e02e56d324a
- SHA512 e38d05bfa21e4f5b00e379c2357ce0bad3b70d9964f54b009a7efe30c5385fe860bf3320b807cc2b802fdaa1f91c8ea85056428daacfb18200336a2db32c7b33
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVPIL:UVqoCl/YgjxEufVU0TbTyDDalGL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 e44a320b7bc01374c75f11cee902c1e4b971bf7d849a6dee5a1485681d6f6936
- MD5 aed9b4c22e11cb1cd327f2164120cf66
- SHA1 4d2a1182105785b42bc56d284cdd1b479159a151
- SHA512 7cc4b03dbe9e9241907dd59dc0e9bccb10dd7887acd9b2634b544ea2fa3a5854f22b1e6aa61116f5aaf1d682edcb4b5147f3d30354f7329a406079507a6a3e85
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVPIx:UVqoCl/YgjxEufVU0TbTyDDalGx
- MD5 SHA1 SHA512 SSDEEP