Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:14
Static task
static1
Behavioral task
behavioral1
Sample
b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe
Resource
win10v2004-20241007-en
General
-
Target
b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe
-
Size
206KB
-
MD5
d9b79a2638e6b7f6df618ffc260a4f50
-
SHA1
7f52dfd1a1c9d6cfd1b8b2b4eb30bef21d57fa81
-
SHA256
b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09e
-
SHA512
4f39e6407730520139e03ead2e1f8ad2d1d7ebb7bd1ddf304934b87937e4f6b274b002d4c9990754364187134e0b052100d0dd95b7224af332ca9cb8866977f1
-
SSDEEP
1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdylllllllllllld:/VqoCl/YgjxEufVU0TbTyDDalbA
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 3012 explorer.exe 2768 spoolsv.exe 2692 svchost.exe 2652 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 3012 explorer.exe 3012 explorer.exe 2768 spoolsv.exe 2768 spoolsv.exe 2692 svchost.exe 2692 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1272 schtasks.exe 2504 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 2692 svchost.exe 2692 svchost.exe 3012 explorer.exe 2692 svchost.exe 3012 explorer.exe 2692 svchost.exe 3012 explorer.exe 2692 svchost.exe 3012 explorer.exe 2692 svchost.exe 3012 explorer.exe 2692 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3012 explorer.exe 2692 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 3012 explorer.exe 3012 explorer.exe 2768 spoolsv.exe 2768 spoolsv.exe 2692 svchost.exe 2692 svchost.exe 2652 spoolsv.exe 2652 spoolsv.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2240 wrote to memory of 3012 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 28 PID 2240 wrote to memory of 3012 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 28 PID 2240 wrote to memory of 3012 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 28 PID 2240 wrote to memory of 3012 2240 b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe 28 PID 3012 wrote to memory of 2768 3012 explorer.exe 29 PID 3012 wrote to memory of 2768 3012 explorer.exe 29 PID 3012 wrote to memory of 2768 3012 explorer.exe 29 PID 3012 wrote to memory of 2768 3012 explorer.exe 29 PID 2768 wrote to memory of 2692 2768 spoolsv.exe 30 PID 2768 wrote to memory of 2692 2768 spoolsv.exe 30 PID 2768 wrote to memory of 2692 2768 spoolsv.exe 30 PID 2768 wrote to memory of 2692 2768 spoolsv.exe 30 PID 2692 wrote to memory of 2652 2692 svchost.exe 31 PID 2692 wrote to memory of 2652 2692 svchost.exe 31 PID 2692 wrote to memory of 2652 2692 svchost.exe 31 PID 2692 wrote to memory of 2652 2692 svchost.exe 31 PID 3012 wrote to memory of 2660 3012 explorer.exe 32 PID 3012 wrote to memory of 2660 3012 explorer.exe 32 PID 3012 wrote to memory of 2660 3012 explorer.exe 32 PID 3012 wrote to memory of 2660 3012 explorer.exe 32 PID 2692 wrote to memory of 2504 2692 svchost.exe 33 PID 2692 wrote to memory of 2504 2692 svchost.exe 33 PID 2692 wrote to memory of 2504 2692 svchost.exe 33 PID 2692 wrote to memory of 2504 2692 svchost.exe 33 PID 2692 wrote to memory of 1272 2692 svchost.exe 38 PID 2692 wrote to memory of 1272 2692 svchost.exe 38 PID 2692 wrote to memory of 1272 2692 svchost.exe 38 PID 2692 wrote to memory of 1272 2692 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe"C:\Users\Admin\AppData\Local\Temp\b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:16 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2504
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:17 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1272
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2660
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5e74bdbace13696e28262b97979da6b4b
SHA125dca8c586032c4b2184f68bf872667b783dcab1
SHA256c39ad196afb43e403f19d39315470337151e8c0b2cb2e44c29c21a710f68b90c
SHA512c88c888ed64f7905930b8171b1453fc11cd7cb72241e51fc169ef80036ea7df275d85a832168977a4fc955ac00e39ff69061eca0cdeff6f55dcd933016619495
-
Filesize
206KB
MD5785964f6942f83265c6c2cc64eeb036d
SHA13af4d23c17cc71d06abce5ddbed6cc1ea123c854
SHA256be60a44bea61d659e50057c1e7a36bb2b17ef606ae05e8cfa0060d4df90cfc08
SHA512477f409577b8385422eca6dd66a8fdccb51f3184e90103d17db4345dcc28cdf4db2c720123d8b82f4df053138874b40075b81b391a14fa45c416af25356856f8
-
Filesize
206KB
MD5719e41002a49cf38aa93d6c96d88277a
SHA19a499d12b8b73d6d842852e3f145d84b03efa77b
SHA256fbfcd9bc50eb9fadbfeb2b58798c924a9cf551ba8b303657c0b807d255f5f7de
SHA5128bb70bdeba6181dc960867167b1d966897304a0fb7419170b51940c741737a53097e2d2693f2e7d0bcadfa642e4ec4eacdeb24102a7489c43983b3c07e41aced