0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
Size

135KB
MD5

862564a8a4540f133b21faca6665c7f2
SHA1

b80f04e0c110d3de6d04f5abd09da35f7d2192d9
SHA256

0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0
SHA512

26f89530eee531714fbe9952c47f14dc27fc37e9175f2f81a8f075d61ed6d2d95664e3d9a61ab3e91e018e2f0b14338645946ee135c4644739fe0cdd5924415f
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBD:UVqoCl/YgjxEufVU0TbTyDDal7D

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
1904	explorer.exe
2240	spoolsv.exe
2788	svchost.exe
2168	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1904	explorer.exe
2240	spoolsv.exe
2788	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3024	schtasks.exe
1648	schtasks.exe
2064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
1904	explorer.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
1904	explorer.exe
2788	svchost.exe
1904	explorer.exe
2788	svchost.exe
1904	explorer.exe
1904	explorer.exe
2788	svchost.exe
2788	svchost.exe
1904	explorer.exe
1904	explorer.exe
2788	svchost.exe
2788	svchost.exe
1904	explorer.exe
1904	explorer.exe
2788	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2788	svchost.exe
1904	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
1904	explorer.exe
1904	explorer.exe
2240	spoolsv.exe
2240	spoolsv.exe
2788	svchost.exe
2788	svchost.exe
2168	spoolsv.exe
2168	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1904	1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe	30
PID 1732 wrote to memory of 1904	1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe	30
PID 1732 wrote to memory of 1904	1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe	30
PID 1732 wrote to memory of 1904	1732	0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe	30
PID 1904 wrote to memory of 2240	1904	explorer.exe	31
PID 1904 wrote to memory of 2240	1904	explorer.exe	31
PID 1904 wrote to memory of 2240	1904	explorer.exe	31
PID 1904 wrote to memory of 2240	1904	explorer.exe	31
PID 2240 wrote to memory of 2788	2240	spoolsv.exe	32
PID 2240 wrote to memory of 2788	2240	spoolsv.exe	32
PID 2240 wrote to memory of 2788	2240	spoolsv.exe	32
PID 2240 wrote to memory of 2788	2240	spoolsv.exe	32
PID 2788 wrote to memory of 2168	2788	svchost.exe	33
PID 2788 wrote to memory of 2168	2788	svchost.exe	33
PID 2788 wrote to memory of 2168	2788	svchost.exe	33
PID 2788 wrote to memory of 2168	2788	svchost.exe	33
PID 1904 wrote to memory of 2888	1904	explorer.exe	34
PID 1904 wrote to memory of 2888	1904	explorer.exe	34
PID 1904 wrote to memory of 2888	1904	explorer.exe	34
PID 1904 wrote to memory of 2888	1904	explorer.exe	34
PID 2788 wrote to memory of 3024	2788	svchost.exe	35
PID 2788 wrote to memory of 3024	2788	svchost.exe	35
PID 2788 wrote to memory of 3024	2788	svchost.exe	35
PID 2788 wrote to memory of 3024	2788	svchost.exe	35
PID 2788 wrote to memory of 1648	2788	svchost.exe	39
PID 2788 wrote to memory of 1648	2788	svchost.exe	39
PID 2788 wrote to memory of 1648	2788	svchost.exe	39
PID 2788 wrote to memory of 1648	2788	svchost.exe	39
PID 2788 wrote to memory of 2064	2788	svchost.exe	41
PID 2788 wrote to memory of 2064	2788	svchost.exe	41
PID 2788 wrote to memory of 2064	2788	svchost.exe	41
PID 2788 wrote to memory of 2064	2788	svchost.exe	41

C:\Users\Admin\AppData\Local\Temp\0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe
"C:\Users\Admin\AppData\Local\Temp\0ce1893068c123609c22eaa41ebbb86ebd5986c64f54da005f4666da7ce345f0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1904
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2788
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2168
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 19:58 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3024
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 19:59 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1648
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:00 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2064
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
f139bc81d1667ff112cfae33956e8352

SHA1
42bef4016f9d8ef04a3617d47e05ee4dbafb53e6

SHA256
03d22e9dc578e56d4363362ec712164dae7dab9297c25bd5ada0f2a03ef7ae5a

SHA512
f7f7db968dda02a4ce08bd545235611920a5b9b23ed040c0779a3c1ea2e555de8666efdaa0540964871ad9aed93a3f3e5caf03d4569ebe8bbcd185c4da5dd692

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
06aaf40ab2325f4014497c6cbedf79d2

SHA1
f2a45fbec19ea31065a7ef7067e8e0b55f097432

SHA256
5a1b67a36a79f6a911bad3f97ff65759f016b3d99a1250451291f264c30c261e

SHA512
f18ce7478cca7b2a5c608282dc7004eb96d6b852764922ad2fd1fb48a59d89ea24e8e2f651511fd1ed23807dfbfcda709b0638b6a267276cd84f2c72d22ea78c

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
6c3cc58688e104eb740fb6d9680022bf

SHA1
9f55f8a3a3286cf0a8e266aad4fbd739f8881421

SHA256
0d01f0fa2caf205d8d6ce0c95b697aa69928f8f7cc918e85771620ea7f0b37fe

SHA512
19a52f8f4338a3f2801dc97f7e36a31641ee7ee0e47b68e236a19b800e169bc3f9fd4f305d92703d94427e9ae3d11264a61cb753185f340ec313612a31c89585

Download Submit
memory/1732-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1732-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1904-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2168-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2240-29-0x00000000003C0000-0x00000000003DF000-memory.dmp

Filesize
124KB

Download
memory/2240-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2788-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2788-45-0x0000000000280000-0x000000000029F000-memory.dmp

Filesize
124KB

Download