bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
Size

135KB
MD5

c2b70ac803a3125ffcc5f3ac7f0097c6
SHA1

c1234de17084f3150ca662f76af203b80837d917
SHA256

bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e
SHA512

a5dea0aa1c9c6819115ecc9f945b43fda143c2170d3b9a5bf882c2dc166b7eb4257046c201cc0f2eb0c4943818f2a1d2b48ef0aa839ffdffda49aaaeb1d28bcb
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVmu:UVqoCl/YgjxEufVU0TbTyDDalQu

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1332	explorer.exe
2392	spoolsv.exe
2940	svchost.exe
2820	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
1332	explorer.exe
2392	spoolsv.exe
2940	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
576	schtasks.exe
2056	schtasks.exe
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
1332	explorer.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
2940	svchost.exe
1332	explorer.exe
1332	explorer.exe
2940	svchost.exe
2940	svchost.exe
1332	explorer.exe
1332	explorer.exe
2940	svchost.exe
1332	explorer.exe
2940	svchost.exe
2940	svchost.exe
1332	explorer.exe
1332	explorer.exe
2940	svchost.exe
2940	svchost.exe
1332	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2940	svchost.exe
1332	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
1332	explorer.exe
1332	explorer.exe
2392	spoolsv.exe
2392	spoolsv.exe
2940	svchost.exe
2940	svchost.exe
2820	spoolsv.exe
2820	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1332	2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe	30
PID 2596 wrote to memory of 1332	2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe	30
PID 2596 wrote to memory of 1332	2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe	30
PID 2596 wrote to memory of 1332	2596	bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe	30
PID 1332 wrote to memory of 2392	1332	explorer.exe	31
PID 1332 wrote to memory of 2392	1332	explorer.exe	31
PID 1332 wrote to memory of 2392	1332	explorer.exe	31
PID 1332 wrote to memory of 2392	1332	explorer.exe	31
PID 2392 wrote to memory of 2940	2392	spoolsv.exe	32
PID 2392 wrote to memory of 2940	2392	spoolsv.exe	32
PID 2392 wrote to memory of 2940	2392	spoolsv.exe	32
PID 2392 wrote to memory of 2940	2392	spoolsv.exe	32
PID 2940 wrote to memory of 2820	2940	svchost.exe	33
PID 2940 wrote to memory of 2820	2940	svchost.exe	33
PID 2940 wrote to memory of 2820	2940	svchost.exe	33
PID 2940 wrote to memory of 2820	2940	svchost.exe	33
PID 1332 wrote to memory of 2168	1332	explorer.exe	34
PID 1332 wrote to memory of 2168	1332	explorer.exe	34
PID 1332 wrote to memory of 2168	1332	explorer.exe	34
PID 1332 wrote to memory of 2168	1332	explorer.exe	34
PID 2940 wrote to memory of 2908	2940	svchost.exe	35
PID 2940 wrote to memory of 2908	2940	svchost.exe	35
PID 2940 wrote to memory of 2908	2940	svchost.exe	35
PID 2940 wrote to memory of 2908	2940	svchost.exe	35
PID 2940 wrote to memory of 576	2940	svchost.exe	39
PID 2940 wrote to memory of 576	2940	svchost.exe	39
PID 2940 wrote to memory of 576	2940	svchost.exe	39
PID 2940 wrote to memory of 576	2940	svchost.exe	39
PID 2940 wrote to memory of 2056	2940	svchost.exe	41
PID 2940 wrote to memory of 2056	2940	svchost.exe	41
PID 2940 wrote to memory of 2056	2940	svchost.exe	41
PID 2940 wrote to memory of 2056	2940	svchost.exe	41

C:\Users\Admin\AppData\Local\Temp\bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe
"C:\Users\Admin\AppData\Local\Temp\bd72b3de20dc8408a601863b10f0d9cce916ee6f445fbf883749a24fd20a351e.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1332
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2940
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2820
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:41 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2908
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:42 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:576
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:43 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2056
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
09c46c7a241a0d0bba85648b717f0fae

SHA1
4c6cc74e375b72cd140f34e6761f843eb8893633

SHA256
25f44cb58cb099e5fa9591922a40d6fda3781c623913bc445e4be97f4c16b93f

SHA512
4d463e5a978c824dcf8f8552610b911b4f6944562d8853245abe31fa5248ab1d02f2d752b586f8bb8c76a5efbba3a665b154e33fbb606b9d214f4c01542fe26b

Download Submit
\??\c:\windows\resources\spoolsv.exe

Filesize
135KB

MD5
8b1466368f132c7d39cecb1a2dbce277

SHA1
ba8faa89becbee3dfb2fd861facb5f0275a0c517

SHA256
b081b69d4efdff682e4e6b3025dd3a620a7d69c879fb3c6129b4470d91eb0e7a

SHA512
8ce6685388c910b09273d03b72dbcd4546822e1baa7878efd5b7b558c3e136d87b63afdd2b76b9936f8f7548d3882115298c5b192700b27a064d5a3db5b5faf4

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
135KB

MD5
61ede6906748890b3c20bba8ce7e8fad

SHA1
15a70e1aa9f30247b6c9a216fa50116686639e3c

SHA256
bc5c388425835475925150bce1d682863a0adfeb96d8f135a06638a4996f9c18

SHA512
7aaab82bc339d48319db0172e971e1a046b6558646028666c7b46e22680a2d811271c7051e8fc788eb525644ba1b19ee6d025838f59b482d1ba5a51a7756c100

Download Submit
memory/1332-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2392-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2392-31-0x00000000004F0000-0x000000000050F000-memory.dmp

Filesize
124KB

Download
memory/2596-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2596-8-0x00000000003A0000-0x00000000003BF000-memory.dmp

Filesize
124KB

Download
memory/2596-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2820-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2940-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download