Overview

overview

10

Static

static

3

cf59dc9bda...ba.exe

windows7-x64

10

cf59dc9bda...ba.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-01-2025 06:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cf59dc9bda625b3edb165e7c95fe712a2fe95133890bd4bb8dc0d9a58eb6f2ba.exe

  • Size

    135KB

  • MD5

    4a24397b889859404f3c0d3523a128fc

  • SHA1

    fd45a95996ea711114cedd60445cd2701586a31f

  • SHA256

    cf59dc9bda625b3edb165e7c95fe712a2fe95133890bd4bb8dc0d9a58eb6f2ba

  • SHA512

    d6090d2e05398075e3c049c20b137791e333f6a0e3983c32ad58db1ac949c24365762b4dfbac616876be9e6be941d33ec2821669f498422966198577094a2576

  • SSDEEP

    1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVO51mQQQQQQQQQQ0:4VqoCl/YgjxEufVU0TbTyDDala1X

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf59dc9bda625b3edb165e7c95fe712a2fe95133890bd4bb8dc0d9a58eb6f2ba.exe
    "C:\Users\Admin\AppData\Local\Temp\cf59dc9bda625b3edb165e7c95fe712a2fe95133890bd4bb8dc0d9a58eb6f2ba.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4720
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2712
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4672
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5116
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    135KB

    MD5

    36be547ee710791b59530de6f2c3aef7

    SHA1

    926f75c4ce5f4b50474ea47ad797b0e3034f537a

    SHA256

    a356c052c06fa78d9bb36cc4581067d98b6137cf3923bbd45cde8b9737d5c498

    SHA512

    4c4c8f7405c0e13eb3237cc16701eea606adddb5b3c06067d7cc6ebc214138c5ff6cee72f620113cd2392ed57cfdbc37b741f96f42834846611c25a99d7bbf46

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    135KB

    MD5

    c038e82fa1f4235041e53deb80dfd551

    SHA1

    4bf5d4b02a677f374ac0bdff61a700bc5364019f

    SHA256

    710895ab57a61e8c3e03850b38509f411f993b302ce46a00765ea99f26f87c59

    SHA512

    0fde979c29ae6436a783fb1a36f1bea7487729b74555a75fdb856f0f19445a02006141a7274afc8740891b875e19742d2d068130329135aa33b736b2a037d77a

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    135KB

    MD5

    99b9c3548ae205406f0a6ff96820a98e

    SHA1

    89c9d8599285a4b62a1790f316660415f1a42cfe

    SHA256

    4060186424e27a4962b597b61c90fa48f58eae664a35ca43dc6ee4ac8817d012

    SHA512

    18b1cb3b58d830da92e42b378e45805cb4690d6ce2067247b9c40f2130c549a748097e85e6e6b3002272ea3ef70d6ef3cbb5ad63f278bc286506720036ea6953

    Download Submit

  • memory/2712-35-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3620-32-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4672-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4720-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4720-34-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/5116-36-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download