9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Size

2.6MB
MD5

c7c411d41a330167ac7abaa2137b4c53
SHA1

3e62689f23ae159b6cf3547fbaaffd425444a653
SHA256

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b
SHA512

61a3cf287a61526ca8381cf693b0b3ba6dc8478b0c77f24776eab07244e1b13976688efb3f744cfa64020fcda9e7ea0165679eb97015330cc31e8804346a03a1
SSDEEP

49152:+XzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVX:+XzhW148Pd+Tf1mpcOldJQ3/VX

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Detects executables packed with Themida 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2804-0-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
C:\Windows\Resources\Themes\explorer.exe	INDICATOR_EXE_Packed_Themida
behavioral1/memory/1624-12-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
C:\Windows\Resources\spoolsv.exe	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2380-23-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
\Windows\Resources\svchost.exe	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2740-35-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2808-43-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2380-50-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2808-49-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2804-51-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/1624-52-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/1624-53-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/2740-55-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/1624-58-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/1624-62-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/memory/1624-66-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

spoolsv.exesvchost.exespoolsv.exe9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exespoolsv.exe9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

1624 explorer.exe
2380 spoolsv.exe
2740 svchost.exe
2808 spoolsv.exe
Loads dropped DLL 4 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exesvchost.exe

pid process

2804 9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1624 explorer.exe
2380 spoolsv.exe
2740 svchost.exe

pid	process
1624	explorer.exe
2380	spoolsv.exe
2740	svchost.exe
2808	spoolsv.exe

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2804-0-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
C:\Windows\Resources\Themes\explorer.exe	themida
behavioral1/memory/1624-12-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
C:\Windows\Resources\spoolsv.exe	themida
behavioral1/memory/2380-23-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
\Windows\Resources\svchost.exe	themida
behavioral1/memory/2740-35-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2808-43-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2380-50-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2808-49-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2804-51-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/1624-52-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/1624-53-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2740-55-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/1624-58-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/1624-62-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/1624-66-0x0000000000400000-0x0000000000A16000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

svchost.exespoolsv.exe9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe
File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2804 9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1624 explorer.exe
2380 spoolsv.exe
2740 svchost.exe
2808 spoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

840 schtasks.exe
2700 schtasks.exe
1780 schtasks.exe

pid	process
840	schtasks.exe
2700	schtasks.exe
1780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exesvchost.exe

pid	process
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
1624	explorer.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
1624	explorer.exe
2740	svchost.exe
2740	svchost.exe
2740	svchost.exe
1624	explorer.exe
1624	explorer.exe
2740	svchost.exe
1624	explorer.exe
2740	svchost.exe
1624	explorer.exe
2740	svchost.exe
1624	explorer.exe
2740	svchost.exe
1624	explorer.exe
2740	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exeexplorer.exe

pid process

2740 svchost.exe
1624 explorer.exe

pid	process
2740	svchost.exe
1624	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1624	explorer.exe
1624	explorer.exe
2380	spoolsv.exe
2380	spoolsv.exe
2740	svchost.exe
2740	svchost.exe
2808	spoolsv.exe
2808	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2804 wrote to memory of 1624	2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe	explorer.exe
PID 2804 wrote to memory of 1624	2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe	explorer.exe
PID 2804 wrote to memory of 1624	2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe	explorer.exe
PID 2804 wrote to memory of 1624	2804	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe	explorer.exe
PID 1624 wrote to memory of 2380	1624	explorer.exe	spoolsv.exe
PID 1624 wrote to memory of 2380	1624	explorer.exe	spoolsv.exe
PID 1624 wrote to memory of 2380	1624	explorer.exe	spoolsv.exe
PID 1624 wrote to memory of 2380	1624	explorer.exe	spoolsv.exe
PID 2380 wrote to memory of 2740	2380	spoolsv.exe	svchost.exe
PID 2380 wrote to memory of 2740	2380	spoolsv.exe	svchost.exe
PID 2380 wrote to memory of 2740	2380	spoolsv.exe	svchost.exe
PID 2380 wrote to memory of 2740	2380	spoolsv.exe	svchost.exe
PID 2740 wrote to memory of 2808	2740	svchost.exe	spoolsv.exe
PID 2740 wrote to memory of 2808	2740	svchost.exe	spoolsv.exe
PID 2740 wrote to memory of 2808	2740	svchost.exe	spoolsv.exe
PID 2740 wrote to memory of 2808	2740	svchost.exe	spoolsv.exe
PID 1624 wrote to memory of 2548	1624	explorer.exe	Explorer.exe
PID 1624 wrote to memory of 2548	1624	explorer.exe	Explorer.exe
PID 1624 wrote to memory of 2548	1624	explorer.exe	Explorer.exe
PID 1624 wrote to memory of 2548	1624	explorer.exe	Explorer.exe
PID 2740 wrote to memory of 2700	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 2700	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 2700	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 2700	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 1780	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 1780	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 1780	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 1780	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 840	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 840	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 840	2740	svchost.exe	schtasks.exe
PID 2740 wrote to memory of 840	2740	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
"C:\Users\Admin\AppData\Local\Temp\9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2808

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 00:39 /f
5⤵
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 00:40 /f
5⤵
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 00:41 /f
5⤵
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
3⤵
PID:2548

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe
Filesize
2.6MB

MD5
d6d7e32d80eebd2f70085cbd597cbff8

SHA1
b6127656e400d8a55b05e0465292a66612a22bf7

SHA256
d1e9d2311676c05cfbf25ffb77710e14db2a71a675eae1d483804c2af903c01b

SHA512
609ca32f6f515e0834eea954261bf3bed32e394e04eb9a37fdd5fae2e176d42c3d882ee993a0d2e5e0caf33df59f78dcde20951185f71d5d878252fda881595b

Download Submit
C:\Windows\Resources\spoolsv.exe
Filesize
2.6MB

MD5
b4cf877e1c909ad2e3222c19608f582e

SHA1
5a98dc97424b3d1ddde1dd84ab22a8f326979f19

SHA256
d166feb8d24ddcc8f58ad6b9c5c008c9b06b47fcdedd11da7cb20f2a8a1d2119

SHA512
be2cdb7cf0fb74c1c232179577e9b1575698d56a874ff2195582184e6d3ded175e79c195d3842bad3a6414046b7d07ca0f9490fe9c56ac6ed1255f6dba105c1c

Download Submit
\Windows\Resources\svchost.exe
Filesize
2.6MB

MD5
31b71ae390f245e2dfa9a258e09ba483

SHA1
4b9ccb7245df5107cfc9c091814ef551c2b7fe47

SHA256
b99c54ca5e5a6b14d7e64d137f59c522cb9aaa0e3a616de0ad9010577af45a04

SHA512
bdc2fd9447f441a65fff8ad6548b515381230f9e581582d1130ee259a6d7ae910d8e780ea8ee923ef101013e1e0babac286a815b8189346f3b6b367dfed26d22

Download Submit
memory/1624-52-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1624-12-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1624-66-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1624-62-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1624-58-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1624-53-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1624-54-0x0000000003850000-0x0000000003E66000-memory.dmp

Filesize
6.1MB

Download
memory/2380-50-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2380-34-0x0000000003700000-0x0000000003D16000-memory.dmp

Filesize
6.1MB

Download
memory/2380-23-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2740-42-0x0000000003400000-0x0000000003A16000-memory.dmp

Filesize
6.1MB

Download
memory/2740-35-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2740-55-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2804-51-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2804-0-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2804-1-0x00000000770B0000-0x00000000770B2000-memory.dmp

Filesize
8KB

Download
memory/2804-11-0x00000000038A0000-0x0000000003EB6000-memory.dmp

Filesize
6.1MB

Download
memory/2808-43-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2808-49-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads