Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 20:29
Behavioral task
behavioral1
Sample
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
General
-
Target
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe
-
Size
346KB
-
MD5
fb3976aa1f8c95f62ef0e1b1cf9a4db0
-
SHA1
98d8c6acfcba0229be3870ed481549007af90df5
-
SHA256
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aa
-
SHA512
f9ff48aa1cdfd5a18281066555dc19a9e4629f82aa2ac626891596afa35a1eb7e6cf1b1d3fb18e08a554c7db3b42cc7cddde9bd78f51757e2d06e197af0e8c04
-
SSDEEP
6144:8uIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYhuIlWqB6:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wqo
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
svhost.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid Process 1928 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svhost.exedescription ioc Process File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\q: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1352-797-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/1928-1150-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Processes:
resource yara_rule behavioral1/memory/1352-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x0007000000012117-4.dat upx behavioral1/files/0x0007000000016d29-66.dat upx behavioral1/memory/1352-797-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/1928-1150-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
Processes:
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exesvhost.exedescription ioc Process File created C:\Windows\svhost.exe 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exesvhost.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exesvhost.exepid Process 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svhost.exepid Process 1928 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exesvhost.exepid Process 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exesvhost.exepid Process 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe 1928 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exedescription pid Process procid_target PID 1352 wrote to memory of 1928 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 30 PID 1352 wrote to memory of 1928 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 30 PID 1352 wrote to memory of 1928 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 30 PID 1352 wrote to memory of 1928 1352 889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe"C:\Users\Admin\AppData\Local\Temp\889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
346KB
MD5a64fd251171d302b4bd0a8606216a474
SHA19a85f7d9a5a950388ea16bc099b379405260ad94
SHA256e10d7d896d9de52d95e604397f9f152e8ec23a23dbdc6b676ca48f94343da84c
SHA512084115f38a23e2e388e4ad30eaedb0821cf9c7e7c33210afa5637566c24469afe5bb97b438da37940f106486bfee3395f1153a1d7428e8ded6ddfcc498dc3ec2
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
346KB
MD52290022b25e763bfc8198d7668171fd1
SHA1f3eb9b10da705f9ef6c6176fbeba431e3f28a484
SHA256b940be9d55e2a7faf4bec9b6df34e653a9d696d2a73b5f6f705b983f265b8deb
SHA512a2810e369a6ec866856566f430082aa7a13628207598065e887e54e7ba0aa46bc56576550d82453a79d0602f7ffa50172aba2f394888263cffee743fe1aed3f5