Overview

overview

10

Static

static

3

4f7ae903ae...0c.exe

windows7-x64

10

4f7ae903ae...0c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 22:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4f7ae903aeebcaf7f4c7da23a7856647122804922a8c50adf8c6e528d29fd20c.exe

  • Size

    135KB

  • MD5

    88523c116bf58aaf5019cd52e007216f

  • SHA1

    3e7434a331d28f30c23db36718e6cab8ba63b447

  • SHA256

    4f7ae903aeebcaf7f4c7da23a7856647122804922a8c50adf8c6e528d29fd20c

  • SHA512

    ec1b942a4112ffaffb173d6c7489149d087810239f22ee08598315a9bfa06730e231c4f7c9570384a54f66f753c87067e70325d14fc618c287196f92a8011ec4

  • SSDEEP

    1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVuHzXIAAAAAAAAA1:4VqoCl/YgjxEufVU0TbTyDDalcHzXx

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f7ae903aeebcaf7f4c7da23a7856647122804922a8c50adf8c6e528d29fd20c.exe
    "C:\Users\Admin\AppData\Local\Temp\4f7ae903aeebcaf7f4c7da23a7856647122804922a8c50adf8c6e528d29fd20c.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4028
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1600
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1616
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1908
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    135KB

    MD5

    13f464b9ef25ac82dbe1464cb184f52e

    SHA1

    251559c613b9ed93ae58196845c8e9a9c3c139c9

    SHA256

    0d9f715d133ffefec428a5cdc70f3bae7f2c52dcb6e946de56bd678bef711f2c

    SHA512

    5c4c97d57c42e8c2c45cc168590cb6207dcfd4b34a6a18db50cef5e9f4b069c6702aef0a7bf16ad1b97712584016e5d5d401b6b9478748e6e181d42f26def5ba

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    135KB

    MD5

    1ee4dd8409063557a80b665cd50a1b0b

    SHA1

    2e872ef2fbaf0668f793661a42361c505494c6cb

    SHA256

    1304d0d454c6c31ed87c42d42969b1a9920738ecd8dfd11db2aae46b4e2b2799

    SHA512

    62978090098f5862483554c9a5204b92d9cb85022c231a0feac36e8252011a3a856ac23280362af81a790ba24a630446431e7ed166170972aaae598a5e12da96

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    135KB

    MD5

    6b7ff13d3dfcb43e006f1d99228a3cbd

    SHA1

    419b0324181d68c136bd7c6530b13c28a9acd87e

    SHA256

    8a5f37b2ac9edadcf17bd197422855e3346c3a3841c6b54a9d37df6c5d63f47a

    SHA512

    e4cd6770ad41b8bbe3fba24998a6fa8ea5b7a7889bb72d242da0406d10292478281dbdfc3161262881114960840fe233eab3047f902fbd9d7cbae9d95554f838

    Download Submit

  • memory/1600-35-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1616-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1908-36-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4028-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4028-34-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4908-32-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download