Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/08/2026, 14:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe
- Size 135KB
- Sample260826-rvpn5seq51
- SHA256 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8
- MD5 76e8f153013fe688242d5ada509f8821
- SHA1 4eebd24ff44316a2a3ea3595f47f7c641fd2d075
- SHA512 ef698896f06117a0084675fae5fa2149378bb3d2f2616129dfb25b7021629d1a917599afce597c29f3b225f16bc9a42b6cd0de33952cb746eb5bb4b0f5cb3b0a
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVva/:UVqoCl/YgjxEufVU0TbTyDDalNa/
- TLSH T1BAD30A23BF11642DD812C9F168DAE66DBA225E360B91BD077666FB4039B1743B5F020F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 4476 explorer.exe 5000 spoolsv.exe 4068 svchost.exe 1892 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe 4476 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4476 explorer.exe 4068 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 4476 explorer.exe 4476 explorer.exe 5000 spoolsv.exe 5000 spoolsv.exe 4068 svchost.exe 4068 svchost.exe 1892 spoolsv.exe 1892 spoolsv.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3212 wrote to memory of 4476 3212 847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe 84 PID 4476 wrote to memory of 5000 4476 explorer.exe 85 PID 5000 wrote to memory of 4068 5000 spoolsv.exe 86 PID 4068 wrote to memory of 1892 4068 svchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe"C:\Users\Admin\AppData\Local\Temp\847fb855c02816763236cb390befff3c23dd3216fa69ab693ab5db116b0f8dd8.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 8d20dd18735ca3683baf7d002f24718ac7cab3e5f3c7d92398700371b5316d86
- MD5 63740ece520b5c7eb21ec2ce19cfff50
- SHA1 02f592785e4a19c003ebaa94a18b3ca536b602f5
- SHA512 56d035c515887ff162a06b12336ba27998756e3f74d371abb488a9b46816101d15a7e3801690e2ab62c98d2fcd72f7a3a6f84e82c052b74be779b61f6c80934e
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVvaf:UVqoCl/YgjxEufVU0TbTyDDalNaf
- TLSH T108D32823BE40402ED8268AF16CE9EB7EBE2A1E251BD0AE077255FF01257511775F160F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 bc88e0c43a9b9322d72d71483ac8af8a6ac03005957b11badfbf47ac673838dc
- MD5 8ffef0b1c9d65238efbe6cc09d76dbc9
- SHA1 fdc257ffb7a4d1e0c7efced9431d8fc911036183
- SHA512 61653c01820ea9e9ad6584e311deae5f12d8d10dc84c24ddb234804f8ea6814eeb2d6f3987f60f7851cfac0e48c21c3964cdacf204d907f30924e278c16b1b2e
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVvab:UVqoCl/YgjxEufVU0TbTyDDalNab
- TLSH T12CD30A277E54502ED811C5F018A6DB6FB9336F260BA9AD076BA2FB0463B164771F021F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 df85bbc68f9c1686d59e5bb39c930d77d0a8e83fce6ee830cea99e3e40ba2eeb
- MD5 26672992cc08bd5fcd74be446f47fc4e
- SHA1 9eb7d64ae43d41578022a3eb57df28162b816e5a
- SHA512 950a15e70b221449ee0f85a0868649972db9c752257abb724a6acbe6194162ac3aa15b60244bb444954176bb581d9f4e7304c850bcb168525a7457e656ba20e5
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVvad:UVqoCl/YgjxEufVU0TbTyDDalNad
- TLSH T129D3F913BE21902EC97189F168B5DA6EBD121E360BE5EC47736ABB0074725077AF520F
- MD5 SHA1 SHA512 SSDEEP TLSH