3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62

General

Target

3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
Size

630KB
MD5

de428e3a7d4d7ef369f524d81ab63f3b
SHA1

175cf1088027980a6ea136487e0af8ef38d21e16
SHA256

3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62
SHA512

e46c3715e31f9c24454ccda981f1711128361e018f2dfbfe65ae0e9836f1313e52ecb6560c6d2bf84708f6a561dcdbf5a5905c788f76f48496eeb53aa52a0c21
SSDEEP

12288:PFUNDaM85s/AxkQ4xdv3yNIGlSYjjlrg+aaUX:PFOahs4xkQ4DvCNIGl3jjZg+XK

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 6 IoCs

Processes:

3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
4176	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
2868	icsys.icn.exe
3016	explorer.exe
3612	spoolsv.exe
1200	svchost.exe
2540	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

Processes:

3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exeicsys.icn.exeexplorer.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

spoolsv.exesvchost.exespoolsv.exe3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe icsys.icn.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exeicsys.icn.exe

pid	process
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
2868	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

3016 explorer.exe
1200 svchost.exe

pid	process
3016	explorer.exe
1200	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
2868	icsys.icn.exe
2868	icsys.icn.exe
3016	explorer.exe
3016	explorer.exe
3612	spoolsv.exe
3612	spoolsv.exe
1200	svchost.exe
1200	svchost.exe
2540	spoolsv.exe
2540	spoolsv.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 1760 wrote to memory of 4176	1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
PID 1760 wrote to memory of 4176	1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
PID 1760 wrote to memory of 4176	1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
PID 1760 wrote to memory of 2868	1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe	icsys.icn.exe
PID 1760 wrote to memory of 2868	1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe	icsys.icn.exe
PID 1760 wrote to memory of 2868	1760	3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe	icsys.icn.exe
PID 2868 wrote to memory of 3016	2868	icsys.icn.exe	explorer.exe
PID 2868 wrote to memory of 3016	2868	icsys.icn.exe	explorer.exe
PID 2868 wrote to memory of 3016	2868	icsys.icn.exe	explorer.exe
PID 3016 wrote to memory of 3612	3016	explorer.exe	spoolsv.exe
PID 3016 wrote to memory of 3612	3016	explorer.exe	spoolsv.exe
PID 3016 wrote to memory of 3612	3016	explorer.exe	spoolsv.exe
PID 3612 wrote to memory of 1200	3612	spoolsv.exe	svchost.exe
PID 3612 wrote to memory of 1200	3612	spoolsv.exe	svchost.exe
PID 3612 wrote to memory of 1200	3612	spoolsv.exe	svchost.exe
PID 1200 wrote to memory of 2540	1200	svchost.exe	spoolsv.exe
PID 1200 wrote to memory of 2540	1200	svchost.exe	spoolsv.exe
PID 1200 wrote to memory of 2540	1200	svchost.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
"C:\Users\Admin\AppData\Local\Temp\3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- \??\c:\users\admin\appdata\local\temp\3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
  c:\users\admin\appdata\local\temp\3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4176
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3612
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1200
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3c28db7d5274460189167458e4120cc0fd607e2a63d94b0e1004f37049f63a62.exe

Filesize
495KB

MD5
d3205e595a423a7900ec8a368feaaafe

SHA1
98bf400147e6c93fe8399f7cecdfa09d4dedfc2e

SHA256
9d0b92f0257a6f3b99ced38d27b2db2fc7165c1f07d2fff656a0c87313a33a9c

SHA512
0732fd230c0420c987de7d54e6d5c3d79a8ccfa417c857d408dc8376d6a6e8b307cc9ed29ef15209c21addd91233155e4ed3fb203bde336aaf79cea816ede412

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
21c4fd611b503c6eaf2bd46bac9fe528

SHA1
85dd95b117e6084e72d701886de4babaadf3b3a1

SHA256
8766aba0bb965093c1ed397ee3f7be6e78c70b79d1b1ccc0ec636f4d053f4590

SHA512
fa0af5625252efcadf33c43226bca70a6143fdb1ab68a7503db3d464a8f69c8a97715a40e617e2891b18e3d8cf1b20a6ef525b906197e51dc318b72fe6e2da25

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
3733cf8be2beaf37b512c4b4fc95e607

SHA1
33963c28544c7df9ffac981db215c8096f9e0217

SHA256
e4ad273aab3d07096b40c228087565ecd911416735757db13e6d8b7b01619995

SHA512
6cd0f30af91c38630bdeb7d8797fc961a3814dcbd09ef18db72949c7e4d22ff5af758deaa9a7a363cc8559fa414f7c84c1eb83cc8d72028cd960ab367a6aa979

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
dcbd30309cf79d2d6bcab476fae81d34

SHA1
48d5c273930ca41688eb4da1c5b85cf0d0d9f612

SHA256
0a000de0874a8b5931d3fb0fda5c9bfc6ab6c4e575bd6d2cbae6e4f71573b743

SHA512
6f4dfbe2df61bfa55d7e6c990b695434a6216382ae1db722b3b63a7869a40cfcb721389a093038ca5f2b684fba674b9d97063b30809396f2d5aa3789ad93be2d

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
084935a66c61c28f2dee533a30cfbe7d

SHA1
f1e48a4fe1b008838f091b915d5e3356fa646c71

SHA256
c79f4392772c1ec1afea04af9c4f2f93bebff02aebdd8ea44e54f82afa2ec34b

SHA512
49fe22c5a23cab6f6ef1e43bb4be1c9ae4321c04c73e79d420ba09030afbe6987c26b3136f1508ca2776aee981b9efc23a7352f4bd119532be6e2b62ee9dd66d

Download Submit
memory/1200-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1760-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1760-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2540-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2868-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3016-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3612-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads