Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2025, 09:14

General

  • Target

    b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe

  • Size

    206KB

  • MD5

    d9b79a2638e6b7f6df618ffc260a4f50

  • SHA1

    7f52dfd1a1c9d6cfd1b8b2b4eb30bef21d57fa81

  • SHA256

    b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09e

  • SHA512

    4f39e6407730520139e03ead2e1f8ad2d1d7ebb7bd1ddf304934b87937e4f6b274b002d4c9990754364187134e0b052100d0dd95b7224af332ca9cb8866977f1

  • SSDEEP

    1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdylllllllllllld:/VqoCl/YgjxEufVU0TbTyDDalbA

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe
    "C:\Users\Admin\AppData\Local\Temp\b940c9916cffd184e0f26b2e8c3c12e326f5c7bea8d1cd9fe5af68953ca4d09eN.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2240
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3012
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2768
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2692
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2652
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:16 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2504
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:17 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1272
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      206KB

      MD5

      e74bdbace13696e28262b97979da6b4b

      SHA1

      25dca8c586032c4b2184f68bf872667b783dcab1

      SHA256

      c39ad196afb43e403f19d39315470337151e8c0b2cb2e44c29c21a710f68b90c

      SHA512

      c88c888ed64f7905930b8171b1453fc11cd7cb72241e51fc169ef80036ea7df275d85a832168977a4fc955ac00e39ff69061eca0cdeff6f55dcd933016619495

    • \Windows\Resources\spoolsv.exe

      Filesize

      206KB

      MD5

      785964f6942f83265c6c2cc64eeb036d

      SHA1

      3af4d23c17cc71d06abce5ddbed6cc1ea123c854

      SHA256

      be60a44bea61d659e50057c1e7a36bb2b17ef606ae05e8cfa0060d4df90cfc08

      SHA512

      477f409577b8385422eca6dd66a8fdccb51f3184e90103d17db4345dcc28cdf4db2c720123d8b82f4df053138874b40075b81b391a14fa45c416af25356856f8

    • \Windows\Resources\svchost.exe

      Filesize

      206KB

      MD5

      719e41002a49cf38aa93d6c96d88277a

      SHA1

      9a499d12b8b73d6d842852e3f145d84b03efa77b

      SHA256

      fbfcd9bc50eb9fadbfeb2b58798c924a9cf551ba8b303657c0b807d255f5f7de

      SHA512

      8bb70bdeba6181dc960867167b1d966897304a0fb7419170b51940c741737a53097e2d2693f2e7d0bcadfa642e4ec4eacdeb24102a7489c43983b3c07e41aced

    • memory/2240-0-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2240-13-0x00000000004B0000-0x00000000004DF000-memory.dmp

      Filesize

      188KB

    • memory/2240-54-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2652-52-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2692-56-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2768-40-0x0000000000330000-0x000000000035F000-memory.dmp

      Filesize

      188KB

    • memory/2768-53-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3012-26-0x0000000000340000-0x000000000036F000-memory.dmp

      Filesize

      188KB

    • memory/3012-55-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB