d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
Size

135KB
MD5

6846d3a6156030f790645430397d3d65
SHA1

be370f708018d3e34ef09b0199b3c93dac8304ac
SHA256

d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e
SHA512

9b55a1d95f8fb5316f66198e35f75d36f1026e7ad51e1ab9da3fa7e7732f58b87afeb69ad3fd6035ea7ed2ea9a7b83073c66d4ce8438646e9656e8586df6e8cb
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalY:UVqoCl/YgjxEufVU0TbTyDDalQlY

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2340	explorer.exe
2464	spoolsv.exe
2540	svchost.exe
2912	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2340	explorer.exe
2464	spoolsv.exe
2540	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1996	schtasks.exe
1680	schtasks.exe
2968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2540	svchost.exe
2540	svchost.exe
2540	svchost.exe
2340	explorer.exe
2340	explorer.exe
2540	svchost.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2340	explorer.exe
2540	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2340	explorer.exe
2540	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
2340	explorer.exe
2340	explorer.exe
2464	spoolsv.exe
2464	spoolsv.exe
2540	svchost.exe
2540	svchost.exe
2912	spoolsv.exe
2912	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2340	2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe	31
PID 2392 wrote to memory of 2340	2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe	31
PID 2392 wrote to memory of 2340	2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe	31
PID 2392 wrote to memory of 2340	2392	d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe	31
PID 2340 wrote to memory of 2464	2340	explorer.exe	32
PID 2340 wrote to memory of 2464	2340	explorer.exe	32
PID 2340 wrote to memory of 2464	2340	explorer.exe	32
PID 2340 wrote to memory of 2464	2340	explorer.exe	32
PID 2464 wrote to memory of 2540	2464	spoolsv.exe	33
PID 2464 wrote to memory of 2540	2464	spoolsv.exe	33
PID 2464 wrote to memory of 2540	2464	spoolsv.exe	33
PID 2464 wrote to memory of 2540	2464	spoolsv.exe	33
PID 2540 wrote to memory of 2912	2540	svchost.exe	34
PID 2540 wrote to memory of 2912	2540	svchost.exe	34
PID 2540 wrote to memory of 2912	2540	svchost.exe	34
PID 2540 wrote to memory of 2912	2540	svchost.exe	34
PID 2340 wrote to memory of 536	2340	explorer.exe	35
PID 2340 wrote to memory of 536	2340	explorer.exe	35
PID 2340 wrote to memory of 536	2340	explorer.exe	35
PID 2340 wrote to memory of 536	2340	explorer.exe	35
PID 2540 wrote to memory of 2968	2540	svchost.exe	36
PID 2540 wrote to memory of 2968	2540	svchost.exe	36
PID 2540 wrote to memory of 2968	2540	svchost.exe	36
PID 2540 wrote to memory of 2968	2540	svchost.exe	36
PID 2540 wrote to memory of 1996	2540	svchost.exe	39
PID 2540 wrote to memory of 1996	2540	svchost.exe	39
PID 2540 wrote to memory of 1996	2540	svchost.exe	39
PID 2540 wrote to memory of 1996	2540	svchost.exe	39
PID 2540 wrote to memory of 1680	2540	svchost.exe	42
PID 2540 wrote to memory of 1680	2540	svchost.exe	42
PID 2540 wrote to memory of 1680	2540	svchost.exe	42
PID 2540 wrote to memory of 1680	2540	svchost.exe	42

C:\Users\Admin\AppData\Local\Temp\d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe
"C:\Users\Admin\AppData\Local\Temp\d49bc433cf5da708864084ac81fd540db14a92ed57971e4b9a45bfee15439a6e.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2540
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2912
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:05 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2968
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:06 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1996
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:07 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1680
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
5cbe3d2ceb762b3e5cf884d179ea19a3

SHA1
0f1f40e9f51ac921f295cd2f1fe1b382d47682c7

SHA256
8f81c010fdfaa80202c15c1df7c03b3686ebad1d84f036ade3a3ea07d41a9b57

SHA512
b9e97ea09bd350d7de86490200601d1d0e095744b218557558f60115b3ba24a45a99fb4d7df6786f218bfd9d569dec279d82612ecf341618357b78940797c118

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
06f6e9ef41bbaa167f70ca345bce0904

SHA1
bcfe6a5f7f0d9f4e537d4fb5dd9930d994c5450c

SHA256
01f0033e14a4ad73d79eca023685c0a546c35a18c83aecea4af36f21472c9065

SHA512
0fc05c1ab1ff0d5ec753843ea62c9584301437eb4d1028706625f32b8d7552ed24dcf52bb8e486c7382956bd09085ab07cd8d2b91127da7dc2045960ff2fd353

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
b2b26ac16d07a3511aef93a013f48745

SHA1
ed92709209c5fd0ce4db23cd6832a3b85a4e9dc2

SHA256
d7344ae86eab78bff52b8752365985177e094e82ac7a96beac71f1293097aef8

SHA512
c7672b0161ee5279d85a946589f6d5717ed4fd946bb2c64e5d4da44d841050cf3e0ab189036dba246e96c8c8649b6dcecaaf6c88cae8f2f98797ae9e74819e95

Download Submit
memory/2340-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2392-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2392-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2464-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2540-35-0x00000000002F0000-0x000000000030F000-memory.dmp

Filesize
124KB

Download
memory/2540-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2912-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download