Analysis
-
max time kernel
118s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 11:39
Static task
static1
Behavioral task
behavioral1
Sample
459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe
Resource
win10v2004-20241007-en
General
-
Target
459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe
-
Size
76KB
-
MD5
c5f54aa98d9b341b2ceb83459528d460
-
SHA1
b8beb5f15111a45804d6f596fe7438eba9d7d6e5
-
SHA256
459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83b
-
SHA512
ad9f4eda59744723c19dd808efac0d95b2f843162fa874a348e9340e3c65aaccf347d58d71c589fee25acede4381f5f9815cc46567e70097785f61c28ca9b7c3
-
SSDEEP
768:lembNRqsuhlGOBrhgFwumSCbxTGy/BBGg4NKJJKqUThbJ32+ve7i40vN0TlT+Xk6:Lnqdu3abBGy3G8V0iuoi
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" dsnv.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dsnv.exe -
Executes dropped EXE 1 IoCs
pid Process 1956 dsnv.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt dsnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm" dsnv.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: dsnv.exe File opened (read-only) \??\P: dsnv.exe File opened (read-only) \??\Q: dsnv.exe File opened (read-only) \??\S: dsnv.exe File opened (read-only) \??\K: dsnv.exe File opened (read-only) \??\M: dsnv.exe File opened (read-only) \??\V: dsnv.exe File opened (read-only) \??\X: dsnv.exe File opened (read-only) \??\Y: dsnv.exe File opened (read-only) \??\E: dsnv.exe File opened (read-only) \??\H: dsnv.exe File opened (read-only) \??\R: dsnv.exe File opened (read-only) \??\U: dsnv.exe File opened (read-only) \??\G: dsnv.exe File opened (read-only) \??\N: dsnv.exe File opened (read-only) \??\J: dsnv.exe File opened (read-only) \??\L: dsnv.exe File opened (read-only) \??\T: dsnv.exe File opened (read-only) \??\W: dsnv.exe File opened (read-only) \??\Z: dsnv.exe File opened (read-only) \??\B: dsnv.exe File opened (read-only) \??\I: dsnv.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\maxtrox.txt 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe File created \??\c:\windows\SysWOW64\Windows 3D.scr 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe File opened for modification \??\c:\windows\SysWOW64\maxtrox.txt dsnv.exe File opened for modification \??\c:\windows\SysWOW64\Windows 3D.scr dsnv.exe File created \??\c:\windows\SysWOW64\Desktop.sysm dsnv.exe File created \??\c:\windows\SysWOW64\CommandPrompt.Sysm dsnv.exe -
Drops file in Program Files directory 27 IoCs
description ioc Process File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe dsnv.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe dsnv.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe dsnv.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.exe dsnv.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe dsnv.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.exe dsnv.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpconfig.exe dsnv.exe File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.exe dsnv.exe File opened for modification \??\c:\Program Files\Windows Media Player\setup_wm.exe dsnv.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe dsnv.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnetwk.exe dsnv.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpshare.exe dsnv.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe dsnv.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.exe dsnv.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmplayer.exe dsnv.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.exe dsnv.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe dsnv.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnscfg.exe dsnv.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dsnv.exe -
Modifies registry class 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile dsnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd dsnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm dsnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command dsnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" dsnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" dsnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon dsnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon dsnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command dsnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt dsnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" dsnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" dsnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt dsnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt dsnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" dsnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" dsnv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2620 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe 1956 dsnv.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2620 wrote to memory of 1956 2620 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe 82 PID 2620 wrote to memory of 1956 2620 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe 82 PID 2620 wrote to memory of 1956 2620 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe"C:\Users\Admin\AppData\Local\Temp\459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Modifies system executable filetype association
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\dsnv.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\dsnv.exe" 459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1956
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD52eaabfdcf3742c35f327725ce3c4f599
SHA1b527da43bac41ea6767454ff5c2f2727586301d6
SHA2563f87592a38d97099f1ca180686e2828e3271bd0ec122a26921688c366babaf9b
SHA512c4d6c7b7f75eaef3cc5b893c245afd447398a3fe0bcee6d24e0de69b0071c7f173e9ec8d21357828025821a7be72a01492dec6f774d349697bcce9fc9be55853
-
Filesize
76KB
MD509a08493881c94ff4c5856e2d67f745f
SHA13b20b7c0305cf4ece33729214990fa284f83afd1
SHA256070bde3ff1b96145631ae50ea1f2ade1c9e96ada23f5e9670cc4f216e9e4c0d5
SHA512cc315935e00a3480b34e4588f41b845a82bb3ff839a64c615e026b6f16dc5177d954cee3a1c9acfde5c7461863005a5e9dafe1270f52defa5593b9d43422921b
-
Filesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062