Overview

overview

10

Static

static

3

855219e8a3...07.exe

windows7-x64

10

855219e8a3...07.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 00:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    855219e8a3053596540245344f73bb6e7cf7d9f40da3caea1bc91d1a7cc0ba07.exe

  • Size

    135KB

  • MD5

    64f801415647679b0378ce9b29a594d8

  • SHA1

    1f94aa1b85e87e6f3d9d371d646acea0beed9de6

  • SHA256

    855219e8a3053596540245344f73bb6e7cf7d9f40da3caea1bc91d1a7cc0ba07

  • SHA512

    044805215988321a88f3724b37a007339731a79d55e980c7208e9cde2d39d832abb84a3eb2dffb281a4321b30af7ca841778a4ce32800793c17213cf7eb1fbb6

  • SSDEEP

    1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgc0:XVqoCl/YgjxEufVU0TbTyDDalX0

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\855219e8a3053596540245344f73bb6e7cf7d9f40da3caea1bc91d1a7cc0ba07.exe
    "C:\Users\Admin\AppData\Local\Temp\855219e8a3053596540245344f73bb6e7cf7d9f40da3caea1bc91d1a7cc0ba07.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1856
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3728
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4004
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1852
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    135KB

    MD5

    6876482ed4789509f928a73c8d2867f5

    SHA1

    d8381d1b9860cb556555c17ae32fbda665f6764a

    SHA256

    c75812f9c349026b1cb180b1af55cade10cdc8d0b4372165c9871931397cdf6c

    SHA512

    d35ce89b4967b4ff2a4600a07181b8ea8d7123719faca5095b1d7963a6e16a0d69d570c87b0fadc24f59a9f703c759bd5b46295ab89484db474534294d9c152d

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    135KB

    MD5

    5f3827bba526bb03e8d961d14a1cb4b7

    SHA1

    5471bfd8acfa4178ad1f83744c0e40f57b27d79c

    SHA256

    095c70da1ca47371d5532c22cd9da8173ce14930b26e7ea13e8068552e6e4978

    SHA512

    cf4105a7a3cd78996088b8009bf1562bf324c0fda77366ff6e924c857807c8d813c38a6780db9b2529c45781139a6e0ba88b22c72a8c440b693306bcc751c128

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    135KB

    MD5

    f1151dcccaf9d6f6528ab1eab60f9a7f

    SHA1

    7b08af198a8f9404ce94ba1dd82ae4241531c25e

    SHA256

    ee98ab1a673d2a04972dbc22350b40665025b5067e5751dcbbbb6b48a05b7439

    SHA512

    418b2138a4fb051042ed3d2ea3854d1162cf5c64a83736c1595ae1a0dbe06cd5012e54041f34312de69e2f829845cc70e356484d57b662073ec8d6f31d1c7e9d

    Download Submit

  • memory/696-32-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1852-36-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1856-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1856-34-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3728-35-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4004-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download