Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 01:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target svchost.exe
- Size 135KB
- Sample260628-bv4v3aex9w
- SHA256 3dee035170528752e86dd2bf56ef1a6aced920559946f955a4594176f211a605
- MD5 dddf5ed2a5431b02ac3576c27ebeab9a
- SHA1 b0d174a14f5e5bd7f6e36d239d7dd2bd9737ee5c
- SHA512 62b881f16f4a094244d4cdec5bb8b05165918c4bd76bb52e84a2e1c42e921e7d7f257fbc9f7a40c34746d2f26451b764fbef0756a27c901f14865f9e7b29e2e5
- SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalsQffffffffffffffffffffffffffffffffffffZ:UsLqdufVUNDap
- TLSH T1C7D32B27AF20551AD421C8F1A4BAE57CBE144E350BE1FD1B77A6BB0126F1A4376F120B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 6008 explorer.exe 2668 spoolsv.exe 5608 svchost.exe 5616 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe svchost.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 5900 svchost.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe 6008 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 6008 explorer.exe 5608 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 5900 svchost.exe 5900 svchost.exe 6008 explorer.exe 6008 explorer.exe 2668 spoolsv.exe 2668 spoolsv.exe 5608 svchost.exe 5608 svchost.exe 5616 spoolsv.exe 5616 spoolsv.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5900 wrote to memory of 6008 5900 svchost.exe 90 PID 6008 wrote to memory of 2668 6008 explorer.exe 91 PID 2668 wrote to memory of 5608 2668 spoolsv.exe 92 PID 5608 wrote to memory of 5616 5608 svchost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6008 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5616
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 5db09d3dcb22497eab34bedb395616c22d83c29ae1b07c34556fc580ea6c4fd2
- MD5 beb25382625f4ab11bc2fd537ae2c367
- SHA1 b45c973a0e502e5914d32d870b927a4aac6bda0b
- SHA512 88a8ab2bd52e69519c5122bd9a5925d63ce599b546b6cd9e2bf87ddfa9612990374b265c2aafa374243803449d315351b653939cd99f158f304a76b926411904
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV6KORTnAlglmLLLW:UVqoCl/YgjxEufVU0TbTyDDalsb
- TLSH T153D3F827BF24501EE51289F1A8A6E67AB5214F361BD4EE0B7252BF1026F1943B5F031F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 3425730638923943c2192f782d25aa37c6faae75b653d810ec721206aa83e382
- MD5 c4b6575f28bf1992a39595b6e5c97dc6
- SHA1 cca22eabd0097c51c8608a7379d18ca477289248
- SHA512 4c2d19545d1447bae6a6776da0bc5af9c11f393bad71f16672cad5a7b047d8ac6333fb20fb0da622c7379c42319eba45131c82337badf8574307ad22d9f3cf66
- SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalsM555555555555555555555555555555555555o:UsLqdufVUNDaE
- TLSH T15BD3F717BF20452ED81146F1D8A6DA7EB9610E261B90FD5F3266BB1139F2907B2F021F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 75386bcfedc4807587c647a38dff8e4ff43df07bcccc7f133b0b2e8024e28844
- MD5 f0a58cf1cadbb6804c128e742b772a3b
- SHA1 72855be6989da137676d40c077500f40dad55a7e
- SHA512 25800d87cf0f5028be63784de04a11c752f41b1225b6f15e7ba7c6d516bc2264a7e79d09c70d38391c2a6f264668c2d8c79a62bd1bd550100794a51516919dcd
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV6KORTnAlgli:UVqoCl/YgjxEufVU0TbTyDDalsi
- TLSH T18CD3F7177A10D42AC862C5F258A7DA79BD116E250BE2FE4B3371BB6076B260771F120F
- MD5 SHA1 SHA512 SSDEEP TLSH