Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
26-11-2024 01:09
General
-
Target
9aa139668b2654f1ca70477de8fc19ca6214be62bb6eed49efe8a6d210404d00N.exe
-
Size
76KB
-
MD5
6837c99ab4aad2a81b42165194ab5ea0
-
SHA1
5240c3538e1aedbd29e6a927f3d7ca258805fbca
-
SHA256
9aa139668b2654f1ca70477de8fc19ca6214be62bb6eed49efe8a6d210404d00
-
SHA512
dc5fa9ede53098bb386e5f96a9cb530509771e977210475270dbaa705c128079e8d3bb404d6eb5ad027117ba3cd7c5ceada9447a1e1333cf59e7f2c0a654216c
-
SSDEEP
1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoI0:T0aXdfXAyy9DZ+N7eB+II0
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
-
Executes dropped EXE 12 IoCs
-
Loads dropped DLL 21 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 28 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 56 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aa139668b2654f1ca70477de8fc19ca6214be62bb6eed49efe8a6d210404d00N.exe"C:\Users\Admin\AppData\Local\Temp\9aa139668b2654f1ca70477de8fc19ca6214be62bb6eed49efe8a6d210404d00N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9aa139668b2654f1ca70477de8fc19ca6214be62bb6eed49efe8a6d210404d00N.doc"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
76KB
MD550dbceaf77d5af8505a749fc78b46f06
SHA1d4d4f202d2843d6b93dc84d8b5e00f1b1081583d
SHA2562d26923245a7698a08ba2b924c787c4f09fd9039c1e9ac73004361fba15999ec
SHA512385d9f5d0ac47495503a6113adac1190d5f28ec1f6394100ba15d5061bea5bdc58036530f2a9ed44570347c3b4841131a8fd29269537d62e2697e2990205cb9b
-
Filesize
76KB
MD5c48e68e2938d4f0878c7201acc3801c0
SHA1caaacdd516de819e0a2b763e580c2a4fbd509607
SHA2568fae74854b385bfc43bceeba75b4e62e1fd8ae751463958ba504110000bb9f6d
SHA512e42f14aa69fc49e3cc1b5bbcbccdce9f26bd0fcd79b1b1d93c2fa1a9bb1f4200a94cc0e6b1be09257e7994f5c535b38249db93bdbb7b53a7c930b6bd64d9503b
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
76KB
MD5bdae54ab011b04fd9328450b3b60993e
SHA191fcbc02fbb263303f3ee1f16abfb74f7f53fcf6
SHA25622cb087ed331675a3a1d7028c3aee36885fb8e12818d501b6a04965fb902e732
SHA5128005559b331691594511b1d9b94c1a9002ea7cad4f3aac2d3fbc7ec5b3b108ee4dfea3b6bdc10b5c27ca7d89e10f63925ce97e3737f35a2b5ee30b28210f10dc
-
Filesize
76KB
MD57df72b33793910616e0d66ed7c2bb8c7
SHA156a64cf7a7b5dabce72d6f27aeaf4e479195ed70
SHA2567aeaa09b16390b65d5df45307b69e779bd03696652c76861ac884225bfeec7a3
SHA512c03cacafbc6706ffd952d9b0d4454952855f1a606dfc13fdb7ae0bb3d233ca217e5001edc3136f1c42aca1b4aa543af047cb923609fc3195920ed7c9b46734c0
-
Filesize
76KB
MD51e301ce3843677216f4ff97573670075
SHA1be8e44914f2b8f0028d49b603305a0c8c8131f2c
SHA256dec1fc5ecb01c47d79b1aaa777cdc7be0571f25d09332521794b00adcce8ab68
SHA5120369a7318bc7b8f0c56fd73f5cbe80e6f37801cd89946968d3a2357eab9800b5ea419e73d0adb0f9712647c724dbdd8236b6c838feffe1765a6bb6eecd3f5840
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
64KB