893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242

Analysis

max time kernel
190s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe
Size

207KB
MD5

a011ad65d71200216b5959515f687c92
SHA1

03ddaffd11dfa51e8f2e1a2428b7d9444190014a
SHA256

893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242
SHA512

5c406e97ea89d937e34fa84ede893ce48d9271546ff38fb8fb0b938c503826e9845b55dfb2ac255fcdffc40985c95e15892540805bc4df516dc8976d7fbc0bfc
SSDEEP

3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un+:zvEN2U+T6i5LirrllHy4HUcMQY6d

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2192	explorer.exe
3520	spoolsv.exe
4560	svchost.exe
1536	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3816	893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe
3816	893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe
2192	explorer.exe
2192	explorer.exe
4560	svchost.exe
4560	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2192	explorer.exe
4560	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3816	893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe
3816	893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe
2192	explorer.exe
2192	explorer.exe
3520	spoolsv.exe
3520	spoolsv.exe
4560	svchost.exe
4560	svchost.exe
1536	spoolsv.exe
1536	spoolsv.exe
2192	explorer.exe
2192	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2192	3816	893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe	79
PID 3816 wrote to memory of 2192	3816	893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe	79
PID 3816 wrote to memory of 2192	3816	893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe	79
PID 2192 wrote to memory of 3520	2192	explorer.exe	80
PID 2192 wrote to memory of 3520	2192	explorer.exe	80
PID 2192 wrote to memory of 3520	2192	explorer.exe	80
PID 3520 wrote to memory of 4560	3520	spoolsv.exe	81
PID 3520 wrote to memory of 4560	3520	spoolsv.exe	81
PID 3520 wrote to memory of 4560	3520	spoolsv.exe	81
PID 4560 wrote to memory of 1536	4560	svchost.exe	82
PID 4560 wrote to memory of 1536	4560	svchost.exe	82
PID 4560 wrote to memory of 1536	4560	svchost.exe	82
PID 4560 wrote to memory of 972	4560	svchost.exe	83
PID 4560 wrote to memory of 972	4560	svchost.exe	83
PID 4560 wrote to memory of 972	4560	svchost.exe	83
PID 4560 wrote to memory of 1908	4560	svchost.exe	91
PID 4560 wrote to memory of 1908	4560	svchost.exe	91
PID 4560 wrote to memory of 1908	4560	svchost.exe	91
PID 4560 wrote to memory of 2504	4560	svchost.exe	95
PID 4560 wrote to memory of 2504	4560	svchost.exe	95
PID 4560 wrote to memory of 2504	4560	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe
"C:\Users\Admin\AppData\Local\Temp\893b5abd71b4739360a4399dd0264e1e847161690bd563e1f8138e117f55a242.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2192
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:972
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:57 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1908
    - - C:\Windows\SysWOW64\at.exe
        
        at 17:58 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
b31bb581c4d6784f05aa782a8a588e7d

SHA1
ecea1a1c744ccde672577c65187e129e1e5cd968

SHA256
60f277a040df08d7ec75d76e201f59f27c4649d975c7339055b2e39d7780c24b

SHA512
8d6598e909e95bd7a470c2c0cead6d417f5b4a8d0e5c772c802976fce76753b96c00c11cd291bc79468fc2f197be7a517297b9de75637c4c17f818cbf7cb472b

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
93e4568551d91cd37de0a56d627850fa

SHA1
0aa52d5aa9a1038e8d6120db823c7fedf94e9474

SHA256
53cb2113d37451605089796f380c56c4d3d2769c0e05a91393a52007af601681

SHA512
2044ee0c1e2127e6d1031c1288b4cdc35d90657edfc254c3b121fb04b27d020dcecb333791b2f2f8457663958d6dc7dcca8e093fd975f5b9f70b02f6d1bea5bc

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
4d0668c32f29a9d18cfbde06c0ed6b3c

SHA1
e245e0ab5b474b95ba6d68c534888d1ab8a69d81

SHA256
8737791c8a24b042d2ebbcb1b95a422ee91caf2a777b151be35fe9ef3d010b83

SHA512
796ce7040fb00303bc61f3a7e513b2ff129cdbda466e086b9ca081b81bf4358d9056520cd8372fd0af4974fa33c079da635f9981a26a725bd08d6c3e9623a510

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
4d0668c32f29a9d18cfbde06c0ed6b3c

SHA1
e245e0ab5b474b95ba6d68c534888d1ab8a69d81

SHA256
8737791c8a24b042d2ebbcb1b95a422ee91caf2a777b151be35fe9ef3d010b83

SHA512
796ce7040fb00303bc61f3a7e513b2ff129cdbda466e086b9ca081b81bf4358d9056520cd8372fd0af4974fa33c079da635f9981a26a725bd08d6c3e9623a510

Download Submit
C:\Windows\System\svchost.exe

Filesize
206KB

MD5
27e5c6400e58c6aadd807277d8f97932

SHA1
bebb7c6c3fde5659d15d3467e08db8871bc3bbb5

SHA256
ad08729e7cbfa75c738354c15f6f89c864fbd06c3f1aad0e6712b300093bc72e

SHA512
7f8d126e5de1c95604f7eadc0c634a0dde4b72534f44cef91553381d4cbe3d8afa40a4fae059a61fa1c8eb084887e267c4b42e3b435f497f5dfef9a14e5c72a5

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
93e4568551d91cd37de0a56d627850fa

SHA1
0aa52d5aa9a1038e8d6120db823c7fedf94e9474

SHA256
53cb2113d37451605089796f380c56c4d3d2769c0e05a91393a52007af601681

SHA512
2044ee0c1e2127e6d1031c1288b4cdc35d90657edfc254c3b121fb04b27d020dcecb333791b2f2f8457663958d6dc7dcca8e093fd975f5b9f70b02f6d1bea5bc

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
4d0668c32f29a9d18cfbde06c0ed6b3c

SHA1
e245e0ab5b474b95ba6d68c534888d1ab8a69d81

SHA256
8737791c8a24b042d2ebbcb1b95a422ee91caf2a777b151be35fe9ef3d010b83

SHA512
796ce7040fb00303bc61f3a7e513b2ff129cdbda466e086b9ca081b81bf4358d9056520cd8372fd0af4974fa33c079da635f9981a26a725bd08d6c3e9623a510

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
27e5c6400e58c6aadd807277d8f97932

SHA1
bebb7c6c3fde5659d15d3467e08db8871bc3bbb5

SHA256
ad08729e7cbfa75c738354c15f6f89c864fbd06c3f1aad0e6712b300093bc72e

SHA512
7f8d126e5de1c95604f7eadc0c634a0dde4b72534f44cef91553381d4cbe3d8afa40a4fae059a61fa1c8eb084887e267c4b42e3b435f497f5dfef9a14e5c72a5

Download Submit