5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe
Size

206KB
MD5

d9ec8b374c459ddf0929508a5b3dc86d
SHA1

23b90679c3ac4b55112a03c406d6bc666bb7ca9b
SHA256

5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e
SHA512

5fad99cf6d600900f64981bc3c06ac39b65b4e80e6b32c45b26031e352546c0b8974768aff1cbfbf6c5d7060eb3fa3347cbd39f672e51b92f97f7aaf40bcde3b
SSDEEP

3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unK+:zvEN2U+T6i5LirrllHy4HUcMQY6Y

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1160	explorer.exe
592	spoolsv.exe
320	svchost.exe
1924	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Loads dropped DLL 8 IoCs

pid	Process
1492	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe
1492	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe
1160	explorer.exe
1160	explorer.exe
592	spoolsv.exe
592	spoolsv.exe
320	svchost.exe
320	svchost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1492	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe
1160	explorer.exe
1160	explorer.exe
1160	explorer.exe
1160	explorer.exe
320	svchost.exe
320	svchost.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
1160	explorer.exe
320	svchost.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
1160	explorer.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe
320	svchost.exe
1160	explorer.exe
1160	explorer.exe
320	svchost.exe
320	svchost.exe
1160	explorer.exe
320	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1160	explorer.exe
320	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1492	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe
1492	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe
1160	explorer.exe
1160	explorer.exe
592	spoolsv.exe
592	spoolsv.exe
320	svchost.exe
320	svchost.exe
1924	spoolsv.exe
1924	spoolsv.exe
1160	explorer.exe
1160	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1160	1492	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe	27
PID 1492 wrote to memory of 1160	1492	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe	27
PID 1492 wrote to memory of 1160	1492	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe	27
PID 1492 wrote to memory of 1160	1492	5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe	27
PID 1160 wrote to memory of 592	1160	explorer.exe	28
PID 1160 wrote to memory of 592	1160	explorer.exe	28
PID 1160 wrote to memory of 592	1160	explorer.exe	28
PID 1160 wrote to memory of 592	1160	explorer.exe	28
PID 592 wrote to memory of 320	592	spoolsv.exe	29
PID 592 wrote to memory of 320	592	spoolsv.exe	29
PID 592 wrote to memory of 320	592	spoolsv.exe	29
PID 592 wrote to memory of 320	592	spoolsv.exe	29
PID 320 wrote to memory of 1924	320	svchost.exe	30
PID 320 wrote to memory of 1924	320	svchost.exe	30
PID 320 wrote to memory of 1924	320	svchost.exe	30
PID 320 wrote to memory of 1924	320	svchost.exe	30
PID 320 wrote to memory of 1640	320	svchost.exe	31
PID 320 wrote to memory of 1640	320	svchost.exe	31
PID 320 wrote to memory of 1640	320	svchost.exe	31
PID 320 wrote to memory of 1640	320	svchost.exe	31
PID 320 wrote to memory of 844	320	svchost.exe	33
PID 320 wrote to memory of 844	320	svchost.exe	33
PID 320 wrote to memory of 844	320	svchost.exe	33
PID 320 wrote to memory of 844	320	svchost.exe	33
PID 320 wrote to memory of 1144	320	svchost.exe	35
PID 320 wrote to memory of 1144	320	svchost.exe	35
PID 320 wrote to memory of 1144	320	svchost.exe	35
PID 320 wrote to memory of 1144	320	svchost.exe	35

C:\Users\Admin\AppData\Local\Temp\5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe
"C:\Users\Admin\AppData\Local\Temp\5b18e97017ae8f2d6216ffdd7b4a6db56e412f5ecf61a5eff6d2af30bbc8271e.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1160
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:592
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies Installed Components in the registry
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1640
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:844
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
be27ea22bb38d7a9eaba82b10bb58dfc

SHA1
78c0624d3f12454ad7c2798c306c8c95416e79ff

SHA256
976630dd65e2e404f9ce57a4485efd924353adfdfc15a45e98ec3cb97a67db67

SHA512
01cedfa0edde8e4f9a77bb01f5f3f826506c69b5a2225c58674baafa87e955fdf3d56ed7d2532e06fb16e56a7e15c49a05a6fa4a2eb58e1bf2c3905057fb0ea9

Download Submit
C:\Windows\system\explorer.exe

Filesize
207KB

MD5
8868390594f16c001b8af3b15fe6b75c

SHA1
a80633d27f9e4e618695c874fd5901b8681ec48c

SHA256
0690692734f61f4b763f317523e4c74394738de1ed940bd39e34ce5f3e50f89c

SHA512
7a98fb9965de6df056aace3fa098cc34861dbd79e3d5e17d24333e599ffff730160deb688d507d5677ed52880b833f116dce3e5295317b96080edb64765ca621

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
206KB

MD5
91ffd1163b8f14ba258c0e7ca01c7f4c

SHA1
93e6066561871810d5002ddd801b986dde23adc6

SHA256
1258e6aeea0d150da856000e308197f6132448e243e7d01ef2e494f94a3619c5

SHA512
a919c1f9e3833b30fdabf79c93006bb04ea3968c00b7c1718cd08b231b3c05405dce671a6bf0779a19b63908df17bb2af019c27a1be07b6bf5c3c92af1b4d297

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
206KB

MD5
91ffd1163b8f14ba258c0e7ca01c7f4c

SHA1
93e6066561871810d5002ddd801b986dde23adc6

SHA256
1258e6aeea0d150da856000e308197f6132448e243e7d01ef2e494f94a3619c5

SHA512
a919c1f9e3833b30fdabf79c93006bb04ea3968c00b7c1718cd08b231b3c05405dce671a6bf0779a19b63908df17bb2af019c27a1be07b6bf5c3c92af1b4d297

Download Submit
C:\Windows\system\svchost.exe

Filesize
206KB

MD5
56be5477933612ea30108ecc647353ff

SHA1
a602624c0a5d611f1619425a46f40d89f007cf82

SHA256
b4ba500ebc4d73af3fa309ad0ba356b7b6784d83c914841fb653d6813decea52

SHA512
85cd7738ca3f87e4391f21962404112733ec21f63f6a71ac8c47c46caab7115536871df5fbde7ea8fbd3b0cb648d4b01fa37a7a2f5dd5415861385c2f499e8c3

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
207KB

MD5
8868390594f16c001b8af3b15fe6b75c

SHA1
a80633d27f9e4e618695c874fd5901b8681ec48c

SHA256
0690692734f61f4b763f317523e4c74394738de1ed940bd39e34ce5f3e50f89c

SHA512
7a98fb9965de6df056aace3fa098cc34861dbd79e3d5e17d24333e599ffff730160deb688d507d5677ed52880b833f116dce3e5295317b96080edb64765ca621

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
91ffd1163b8f14ba258c0e7ca01c7f4c

SHA1
93e6066561871810d5002ddd801b986dde23adc6

SHA256
1258e6aeea0d150da856000e308197f6132448e243e7d01ef2e494f94a3619c5

SHA512
a919c1f9e3833b30fdabf79c93006bb04ea3968c00b7c1718cd08b231b3c05405dce671a6bf0779a19b63908df17bb2af019c27a1be07b6bf5c3c92af1b4d297

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
56be5477933612ea30108ecc647353ff

SHA1
a602624c0a5d611f1619425a46f40d89f007cf82

SHA256
b4ba500ebc4d73af3fa309ad0ba356b7b6784d83c914841fb653d6813decea52

SHA512
85cd7738ca3f87e4391f21962404112733ec21f63f6a71ac8c47c46caab7115536871df5fbde7ea8fbd3b0cb648d4b01fa37a7a2f5dd5415861385c2f499e8c3

Download Submit
\Windows\system\explorer.exe

Filesize
207KB

MD5
8868390594f16c001b8af3b15fe6b75c

SHA1
a80633d27f9e4e618695c874fd5901b8681ec48c

SHA256
0690692734f61f4b763f317523e4c74394738de1ed940bd39e34ce5f3e50f89c

SHA512
7a98fb9965de6df056aace3fa098cc34861dbd79e3d5e17d24333e599ffff730160deb688d507d5677ed52880b833f116dce3e5295317b96080edb64765ca621

Download Submit
\Windows\system\explorer.exe

Filesize
207KB

MD5
8868390594f16c001b8af3b15fe6b75c

SHA1
a80633d27f9e4e618695c874fd5901b8681ec48c

SHA256
0690692734f61f4b763f317523e4c74394738de1ed940bd39e34ce5f3e50f89c

SHA512
7a98fb9965de6df056aace3fa098cc34861dbd79e3d5e17d24333e599ffff730160deb688d507d5677ed52880b833f116dce3e5295317b96080edb64765ca621

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
91ffd1163b8f14ba258c0e7ca01c7f4c

SHA1
93e6066561871810d5002ddd801b986dde23adc6

SHA256
1258e6aeea0d150da856000e308197f6132448e243e7d01ef2e494f94a3619c5

SHA512
a919c1f9e3833b30fdabf79c93006bb04ea3968c00b7c1718cd08b231b3c05405dce671a6bf0779a19b63908df17bb2af019c27a1be07b6bf5c3c92af1b4d297

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
91ffd1163b8f14ba258c0e7ca01c7f4c

SHA1
93e6066561871810d5002ddd801b986dde23adc6

SHA256
1258e6aeea0d150da856000e308197f6132448e243e7d01ef2e494f94a3619c5

SHA512
a919c1f9e3833b30fdabf79c93006bb04ea3968c00b7c1718cd08b231b3c05405dce671a6bf0779a19b63908df17bb2af019c27a1be07b6bf5c3c92af1b4d297

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
91ffd1163b8f14ba258c0e7ca01c7f4c

SHA1
93e6066561871810d5002ddd801b986dde23adc6

SHA256
1258e6aeea0d150da856000e308197f6132448e243e7d01ef2e494f94a3619c5

SHA512
a919c1f9e3833b30fdabf79c93006bb04ea3968c00b7c1718cd08b231b3c05405dce671a6bf0779a19b63908df17bb2af019c27a1be07b6bf5c3c92af1b4d297

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
91ffd1163b8f14ba258c0e7ca01c7f4c

SHA1
93e6066561871810d5002ddd801b986dde23adc6

SHA256
1258e6aeea0d150da856000e308197f6132448e243e7d01ef2e494f94a3619c5

SHA512
a919c1f9e3833b30fdabf79c93006bb04ea3968c00b7c1718cd08b231b3c05405dce671a6bf0779a19b63908df17bb2af019c27a1be07b6bf5c3c92af1b4d297

Download Submit
\Windows\system\svchost.exe

Filesize
206KB

MD5
56be5477933612ea30108ecc647353ff

SHA1
a602624c0a5d611f1619425a46f40d89f007cf82

SHA256
b4ba500ebc4d73af3fa309ad0ba356b7b6784d83c914841fb653d6813decea52

SHA512
85cd7738ca3f87e4391f21962404112733ec21f63f6a71ac8c47c46caab7115536871df5fbde7ea8fbd3b0cb648d4b01fa37a7a2f5dd5415861385c2f499e8c3

Download Submit
\Windows\system\svchost.exe

Filesize
206KB

MD5
56be5477933612ea30108ecc647353ff

SHA1
a602624c0a5d611f1619425a46f40d89f007cf82

SHA256
b4ba500ebc4d73af3fa309ad0ba356b7b6784d83c914841fb653d6813decea52

SHA512
85cd7738ca3f87e4391f21962404112733ec21f63f6a71ac8c47c46caab7115536871df5fbde7ea8fbd3b0cb648d4b01fa37a7a2f5dd5415861385c2f499e8c3

Download Submit
memory/1492-57-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download