f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66de

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
Size

1.2MB
MD5

a4446a4f5250b97f4f00a7ec9a0e3d10
SHA1

4fd7c2b72a30009d9eddb7c877fa0db86d552f2e
SHA256

f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66de
SHA512

31f2805e9f90c8bd5bbb609b5e7778077c184ee7134a4032c13da739f0a68a14c56e9107e8c75d58e97eb7cdf3ad9f8bcbf45488a0b2f922af4872709da6c951
SSDEEP

24576:cFOavduSvY3TDxcQq/1vezu72ssMCKBqSulC8wWQ2ie5mZ/l4Fz5Uw0i:sTd1Y3TDxcf1vR72kqSkJXwW56wd

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe
2720	icsys.icn.exe
1844	explorer.exe
4676	spoolsv.exe
2952	svchost.exe
2012	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
2720	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1844	explorer.exe
2952	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
2720	icsys.icn.exe
2720	icsys.icn.exe
1844	explorer.exe
1844	explorer.exe
4676	spoolsv.exe
4676	spoolsv.exe
2952	svchost.exe
2952	svchost.exe
2012	spoolsv.exe
2012	spoolsv.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3068	560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe	84
PID 560 wrote to memory of 3068	560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe	84
PID 560 wrote to memory of 3068	560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe	84
PID 560 wrote to memory of 2720	560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe	85
PID 560 wrote to memory of 2720	560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe	85
PID 560 wrote to memory of 2720	560	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe	85
PID 2720 wrote to memory of 1844	2720	icsys.icn.exe	87
PID 2720 wrote to memory of 1844	2720	icsys.icn.exe	87
PID 2720 wrote to memory of 1844	2720	icsys.icn.exe	87
PID 1844 wrote to memory of 4676	1844	explorer.exe	88
PID 1844 wrote to memory of 4676	1844	explorer.exe	88
PID 1844 wrote to memory of 4676	1844	explorer.exe	88
PID 3068 wrote to memory of 2608	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	89
PID 3068 wrote to memory of 2608	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	89
PID 3068 wrote to memory of 2608	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	89
PID 2608 wrote to memory of 1388	2608	cmd.exe	90
PID 2608 wrote to memory of 1388	2608	cmd.exe	90
PID 2608 wrote to memory of 1388	2608	cmd.exe	90
PID 4676 wrote to memory of 2952	4676	spoolsv.exe	91
PID 4676 wrote to memory of 2952	4676	spoolsv.exe	91
PID 4676 wrote to memory of 2952	4676	spoolsv.exe	91
PID 2952 wrote to memory of 2012	2952	svchost.exe	92
PID 2952 wrote to memory of 2012	2952	svchost.exe	92
PID 2952 wrote to memory of 2012	2952	svchost.exe	92
PID 3068 wrote to memory of 2564	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	93
PID 3068 wrote to memory of 2564	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	93
PID 3068 wrote to memory of 2564	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	93
PID 3068 wrote to memory of 4396	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	94
PID 3068 wrote to memory of 4396	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	94
PID 3068 wrote to memory of 4396	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	94
PID 3068 wrote to memory of 4700	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	95
PID 3068 wrote to memory of 4700	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	95
PID 3068 wrote to memory of 4700	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	95
PID 3068 wrote to memory of 4596	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	96
PID 3068 wrote to memory of 4596	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	96
PID 3068 wrote to memory of 4596	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	96
PID 3068 wrote to memory of 2648	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	97
PID 3068 wrote to memory of 2648	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	97
PID 3068 wrote to memory of 2648	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	97
PID 3068 wrote to memory of 4740	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	98
PID 3068 wrote to memory of 4740	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	98
PID 3068 wrote to memory of 4740	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	98
PID 3068 wrote to memory of 4972	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	99
PID 3068 wrote to memory of 4972	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	99
PID 3068 wrote to memory of 4972	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	99
PID 3068 wrote to memory of 4936	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	100
PID 3068 wrote to memory of 4936	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	100
PID 3068 wrote to memory of 4936	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	100
PID 3068 wrote to memory of 2280	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	101
PID 3068 wrote to memory of 2280	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	101
PID 3068 wrote to memory of 2280	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	101
PID 3068 wrote to memory of 3452	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	102
PID 3068 wrote to memory of 3452	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	102
PID 3068 wrote to memory of 3452	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	102
PID 3068 wrote to memory of 2140	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	103
PID 3068 wrote to memory of 2140	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	103
PID 3068 wrote to memory of 2140	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	103
PID 3068 wrote to memory of 984	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	104
PID 3068 wrote to memory of 984	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	104
PID 3068 wrote to memory of 984	3068	f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe	104

C:\Users\Admin\AppData\Local\Temp\f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe
"C:\Users\Admin\AppData\Local\Temp\f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66deN.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560
- \??\c:\users\admin\appdata\local\temp\f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe
  c:\users\admin\appdata\local\temp\f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c MODE CON COLS=19 LINES=2
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\SysWOW64\mode.com
      MODE CON COLS=19 LINES=2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color A
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color A
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color A
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color A
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color A
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color A
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:984
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4676
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2952
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f3c8b1744ca7e323797d6f87dec7528fdc5587c39f72897a60106e25e92f66den.exe

Filesize
1.1MB

MD5
97e0b85b9ca71655f83bc481798d6efa

SHA1
b8e2d7f0ea99fdd73a916a4c9f765e2d2aa44de4

SHA256
cb6915315cfc5c80f8527cdbe1b78ace0f6ecae43a70685ba8732f86968ba67d

SHA512
1e31c86867a98a902765a83bc01f72fc9d2e818ac59b4715ef9925181217bc21ea74cc382f1ef64b79d25c09468a2bee116fbb04125c41f932b646c9243cebbe

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
b403f0f03f8866e949a9e6b13fd43257

SHA1
12c505083037c04d8d82042743c2b4925f63df8d

SHA256
9f3671eb76f7cc0673d437e0b7ea091acc2c99aa31aa550bed2123e1995168cf

SHA512
d994cfaa4a291a43177d4df02ac1c378c285a8d8bcacfbd66cb22e13a0612e65ae627d0aea91e70396d6294be08a58b53fb82eacc4d7d98e7ca9887f425e2f00

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
6f122a4dd29137760475fa7e0501cd8c

SHA1
5cb54489d31999991ea2b6134a9db5877ab80cac

SHA256
b4d54bac156ac2b8873fc994706e50b4bae8123d1a789db1429213a4447085fc

SHA512
081d94c87988ff33c1af79774dbe16d0ee36a1b62e30ef2b9368147cc17a6e64dca992040a131410f566931df0de4020c5f6a7258384f5c7ec0e4ad4b371630d

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
72085b0668c220fef49f484887e6301a

SHA1
973b32e8b49322c615b62c31378c56349cebf55e

SHA256
8ec9c34e0643238fa2afaa499a0ce642b77d6e3fc10dd9a5a2f7ec9906de03fe

SHA512
fb7d3cd7496ff1bd928cbbf292eaa12f97f886cdc4914031ca82ebae0df365df6d9b1a253d80dddc6dd9cffa13f5b062c72519d2810d9ddbfc22931f1b855ae6

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
8a0848d170fbad62cadcc8aba6bc9847

SHA1
ca027684a4b65e16db523dbd2f650dbeae270cc4

SHA256
035fda7d86400d4750f4a5621e64ed55e5f6bb07bc518cfbdd9136c2310620f7

SHA512
298953913e8de36078d4b6f6ae9311c198f1cfb696bb397bf4a658fbcff770b67498e653b92435066139110d41a8f92254be29df06a6d8f69d3c6d71f94e5655

Download Submit
memory/560-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/560-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1844-21-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1844-51-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2012-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2720-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2952-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3068-9-0x00000000004F0000-0x00000000007D6000-memory.dmp

Filesize
2.9MB

Download
memory/3068-49-0x00000000004F0000-0x00000000007D6000-memory.dmp

Filesize
2.9MB

Download
memory/4676-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download