51a6baae536bc1f992b146be605ddb3b3fc0dcd81432d8a483088835d76ac0d8

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AntiPubs Dork Searcher EZ/._cache_Searcher.exe
Size

7.0MB
MD5

15eb4b61e2e64ac84925535dc5ffe8de
SHA1

b95491efa58261ca585878238fa24d98fae41287
SHA256

3b28aaf3dd8ea9623ab80e4f567e65b8bb5db686b129f27f6d9bc0907f2ed289
SHA512

489751c78f8aded9a4b77eada0cccedab4d0faf50443607e17d81f65856ff77ad2842cb2ba5002e377c48fff441d86d38f74273367353fc2572a80ff980c14b5
SSDEEP

98304:JyldpqU5s+h9oK4MtPSXDjLWdNo/v5LlCKly37gjA1tCJa8IRku6Fml2u:JyldD5smuMQDfUi/vXgIa8IRkZI2u

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
3148	._cache_searcher.exe
2368	icsys.icn.exe
2592	explorer.exe
4804	spoolsv.exe
4800	svchost.exe
940	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	._cache_Searcher.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Searcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_searcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2368	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2592	explorer.exe
4800	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1104	._cache_Searcher.exe
1104	._cache_Searcher.exe
2368	icsys.icn.exe
2368	icsys.icn.exe
2592	explorer.exe
2592	explorer.exe
4804	spoolsv.exe
4804	spoolsv.exe
4800	svchost.exe
4800	svchost.exe
940	spoolsv.exe
940	spoolsv.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3148	1104	._cache_Searcher.exe	81
PID 1104 wrote to memory of 3148	1104	._cache_Searcher.exe	81
PID 1104 wrote to memory of 3148	1104	._cache_Searcher.exe	81
PID 1104 wrote to memory of 2368	1104	._cache_Searcher.exe	82
PID 1104 wrote to memory of 2368	1104	._cache_Searcher.exe	82
PID 1104 wrote to memory of 2368	1104	._cache_Searcher.exe	82
PID 2368 wrote to memory of 2592	2368	icsys.icn.exe	83
PID 2368 wrote to memory of 2592	2368	icsys.icn.exe	83
PID 2368 wrote to memory of 2592	2368	icsys.icn.exe	83
PID 2592 wrote to memory of 4804	2592	explorer.exe	84
PID 2592 wrote to memory of 4804	2592	explorer.exe	84
PID 2592 wrote to memory of 4804	2592	explorer.exe	84
PID 4804 wrote to memory of 4800	4804	spoolsv.exe	85
PID 4804 wrote to memory of 4800	4804	spoolsv.exe	85
PID 4804 wrote to memory of 4800	4804	spoolsv.exe	85
PID 4800 wrote to memory of 940	4800	svchost.exe	86
PID 4800 wrote to memory of 940	4800	svchost.exe	86
PID 4800 wrote to memory of 940	4800	svchost.exe	86

C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\._cache_Searcher.exe
"C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\._cache_Searcher.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- \??\c:\users\admin\appdata\local\temp\antipubs dork searcher ez\._cache_searcher.exe
  "c:\users\admin\appdata\local\temp\antipubs dork searcher ez\._cache_searcher.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3148
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2368
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4804
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4800
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\._cache_searcher.exe

Filesize
6.8MB

MD5
d4b43b2ce490d8786ccde6debcad2251

SHA1
e88d0c6b5c336ee7c03e145532a6ce44db28af90

SHA256
3aad4931bc76e1d654e5fe3fc6a1a10277b0d66190a8547782a3d7fa117ccc27

SHA512
8bff940911e750f06c76c724b92de0753f4089d92f95e5d3d3659de3869a91908c6de25e480a0101d8149fcc881b71f585c39a2e9206393bb89f1f5e43bdda46

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
9df22aeb75f0aed1739557530daa8264

SHA1
d2186d2a433ca3039bff3b206485eee2340588cb

SHA256
ecb02fc272c7c9fbdf276c02323d569b3c24b8374c1e2378e5034b618f1e801e

SHA512
f22d4342aeda22c449a87285078a4c013823601cd82a3c4480759fbc18bc9a01bb8b2ea60322c2ad11b78c5720f06f9966473f8e82b24d5204483929a9da1507

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
bb38812e659c3d728f409ba8206da43e

SHA1
231777c045c807c20eb964c5a8714e1de9e4302b

SHA256
9eee738a0be74282659e61da2764f358cd5db063019bab247d513b5b63af748f

SHA512
91854244be2838e0efa5f3566ce3a4518484ab71fff5f06b86ef0b1309cb9e8dc988d63b0d35e54a6c7515b0c1cea9b95bbdfd469415459a46c58e96ed42a2fc

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
578313be3cb7b5c1b8dacb2be4fdd21c

SHA1
5eec1c65e21f7c631d16e1ae1c15138d54314d2f

SHA256
8a84385a24ed8a99226e2f87a422e816745ec8db02b33aafbfebec8be46ff36e

SHA512
cb440d01ce9402bac037ec1b7bd6d03c02ae48511271536e721208837b2ad56f50b26de411a1ee4a280d930672d0cb92cd5f9083080f74b2471a802280c1c923

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
9aa97d3733bce6f137b358bdd88498ac

SHA1
82a4257e4a1c4afe36f722560a05d19e67294a5b

SHA256
fdaa5a7989fecc276ef876da6e92cf29a0f2e1924ee7daf135419710f3acf3e2

SHA512
edb3224855a27579d7dc36393f8b495dae070530ad97a2f237cafd71d7b7403371ef8b96005a8abb5837a4493c309599767304409874dde872ba0587105ba6bd

Download Submit
memory/940-53-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1104-56-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1104-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2368-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2592-29-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2592-62-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3148-58-0x00000000055F0000-0x00000000055F6000-memory.dmp

Filesize
24KB

Download
memory/3148-10-0x0000000000B00000-0x00000000011D8000-memory.dmp

Filesize
6.8MB

Download
memory/3148-14-0x0000000005B20000-0x0000000005B26000-memory.dmp

Filesize
24KB

Download
memory/3148-13-0x0000000005B30000-0x0000000005B44000-memory.dmp

Filesize
80KB

Download
memory/3148-12-0x0000000005BC0000-0x0000000005C52000-memory.dmp

Filesize
584KB

Download
memory/3148-11-0x0000000006090000-0x0000000006634000-memory.dmp

Filesize
5.6MB

Download
memory/3148-17-0x000000000C300000-0x000000000C30A000-memory.dmp

Filesize
40KB

Download
memory/3148-15-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/3148-9-0x00000000748DE000-0x00000000748DF000-memory.dmp

Filesize
4KB

Download
memory/3148-57-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/3148-16-0x000000000C1A0000-0x000000000C1C0000-memory.dmp

Filesize
128KB

Download
memory/3148-59-0x00000000070A0000-0x0000000007106000-memory.dmp

Filesize
408KB

Download
memory/3148-60-0x00000000748DE000-0x00000000748DF000-memory.dmp

Filesize
4KB

Download
memory/3148-61-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/4800-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4804-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download