Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 21:31
Behavioral task
behavioral1
Sample
ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
General
-
Target
ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe
-
Size
6.5MB
-
MD5
b25c805e405789598bea9999dcafcd86
-
SHA1
4318d8e691d48e2c66aebb0a8bf651dd60cac702
-
SHA256
ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed
-
SHA512
c8e456fec1ff720a2e86b4edc37322fc02d06c8709cfde156d98856a0025e1a5a76638dce8c89a14e4ea81ed782664f0de6cc0c65e548fa7815d5930e45fd08f
-
SSDEEP
98304:dE35cEiE35cEIE35cE7E35cE6E35cESE35cESE35cEzE35cENE35cEnE35cELE3f:p
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
svhost.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid Process 2908 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svhost.exedescription ioc Process File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\z: svhost.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2908-6-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2288-687-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2908-1058-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Processes:
resource yara_rule behavioral1/memory/2288-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x00070000000120fc-4.dat upx behavioral1/memory/2908-6-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x0008000000016d46-66.dat upx behavioral1/memory/2288-687-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/2908-1058-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
Processes:
ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exesvhost.exedescription ioc Process File created C:\Windows\svhost.exe ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exesvhost.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exesvhost.exepid Process 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svhost.exepid Process 2908 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exesvhost.exepid Process 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exesvhost.exepid Process 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe 2908 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exedescription pid Process procid_target PID 2288 wrote to memory of 2908 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 28 PID 2288 wrote to memory of 2908 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 28 PID 2288 wrote to memory of 2908 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 28 PID 2288 wrote to memory of 2908 2288 ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe"C:\Users\Admin\AppData\Local\Temp\ff9e77cbadf1c27e6e582bf7ee201b633a50390ed29a6300b79815e91151e5ed.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
MD5634948c9513164f891957cef0d3f67fc
SHA195cf22ffb886ae1ddd5cbbe43b7b3302061a31c6
SHA25653edc89ab582b711e2394bf660faac4ae969e7332a4492ab42ffcac63a3cea51
SHA5123ed3e865c973dae0a4f00b486ae706ac981ebc3e7a3b24bcf5044caf6eca9ee5833262dd94d3ac69c259d4d95d0fe370eedcf1786019616b988e94dae37b17be
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
6.5MB
MD538a734f180ff906686f2093a54aa5065
SHA1ce6bc383bb27cf1eadd3180556ffa954abd556de
SHA256701195981577fd150dd358b9418c29dc0a1a2636ea04fe558d67935c6bec6a91
SHA512e506f903bc4c75867b441940d78e56a5322d2f13eedef9b9415d5f0cb39cf92e8790a8802723aef3b4ffdc257ebb00a061a4decb7b64a26107d7f04c88d2ec0c