Overview

overview

10

Static

static

3

d57afe4bde...3N.exe

windows7-x64

10

d57afe4bde...3N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2024 05:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d57afe4bded426844343be84945753eaa4d719b73006a4e9db7db8e48f9cd663N.exe

  • Size

    135KB

  • MD5

    c8f3ab345a36a090adb5089efaed77c0

  • SHA1

    cc0b4e2fbf198ad298af1ac03b7e4709d9b51c09

  • SHA256

    d57afe4bded426844343be84945753eaa4d719b73006a4e9db7db8e48f9cd663

  • SHA512

    38f31d1e02c15cb145ceb1fb86490653feae53a5031d8234294d0d79948124633f33aecb1a71f26df3b1ed61d1e5200b80540ae05b43b9d5d8a83f4a11f43b19

  • SSDEEP

    1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgGL:XVqoCl/YgjxEufVU0TbTyDDal5L

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d57afe4bded426844343be84945753eaa4d719b73006a4e9db7db8e48f9cd663N.exe
    "C:\Users\Admin\AppData\Local\Temp\d57afe4bded426844343be84945753eaa4d719b73006a4e9db7db8e48f9cd663N.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1524
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3200
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1280
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4272
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    135KB

    MD5

    aa45e9cd714cc51aadcf8f9142766ea6

    SHA1

    2c90ea782f6e542ecafc2ebf70273b0e6727ad9c

    SHA256

    38ad8e9d37335c9ce60a99c20b6c188eb70e3a561574c3ef543a84f8bd987fb9

    SHA512

    d75831a52a86608440bf8f142e3c3e543b64a5f853fb96c0a6473741ebe338b0fbbf079d6b82b4a05e4fc604895c8abf558fc9f2ed31f9de9aa17b3e45ce69a9

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    135KB

    MD5

    1a4c38b0e928359ee435da3ce0da0bba

    SHA1

    c7292335b3d84f3198af9288d76d23ecbe6a39ce

    SHA256

    c6326fdebd35b6083acf1040d90c383f4d1eb8c41f5a481622f95c74fc4251cf

    SHA512

    24efdbc0f1a69c32dda0ed974c023a9d27c00a5f3761d421bcf24fea31b1b61ce9c313dd934e1da7c56951958a760459990cd4da5b99cfcb52f99190b1c98626

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    135KB

    MD5

    99e8c7813f44628e700ca5490e0ed3cd

    SHA1

    d1cfe8a7217bc72943c5776ff51f0220e62e2ea5

    SHA256

    4673236987bbf3ffe1ef90a8b48aefa80f266846b33572264395f8e80c5d0240

    SHA512

    4bda0be2089357510bbcf68725abe216c703496ed871a1e082825b32ca831424921021ffa22f61150a213ba59ce450daf5d1f771fe89558d04fdb89dae88b9ed

    Download Submit

  • memory/1280-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1524-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1524-34-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2924-32-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3200-35-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4272-36-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download