8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb

Analysis

max time kernel
151s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe
Size

206KB
MD5

83474b43d264b7f69a0569f19b732c6a
SHA1

275d72ddafa5b8e65d52b0d439fa8ebfb9be6255
SHA256

8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb
SHA512

267ba76ae75221b220041e0ac66a4a14f4116485f20299f76c36c66c017dcb3b62b0d2cf091b26bf38341f43ffa53dee187a1c0d5c4b45c77b441ab202988df2
SSDEEP

3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un8N:zvEN2U+T6i5LirrllHy4HUcMQY6dN

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2028	explorer.exe
3068	spoolsv.exe
1664	svchost.exe
4500	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4800	8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe
4800	8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe
1664	svchost.exe
1664	svchost.exe
2028	explorer.exe
2028	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2028	explorer.exe
1664	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4800	8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe
4800	8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe
2028	explorer.exe
2028	explorer.exe
3068	spoolsv.exe
3068	spoolsv.exe
1664	svchost.exe
1664	svchost.exe
4500	spoolsv.exe
4500	spoolsv.exe
2028	explorer.exe
2028	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2028	4800	8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe	81
PID 4800 wrote to memory of 2028	4800	8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe	81
PID 4800 wrote to memory of 2028	4800	8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe	81
PID 2028 wrote to memory of 3068	2028	explorer.exe	82
PID 2028 wrote to memory of 3068	2028	explorer.exe	82
PID 2028 wrote to memory of 3068	2028	explorer.exe	82
PID 3068 wrote to memory of 1664	3068	spoolsv.exe	83
PID 3068 wrote to memory of 1664	3068	spoolsv.exe	83
PID 3068 wrote to memory of 1664	3068	spoolsv.exe	83
PID 1664 wrote to memory of 4500	1664	svchost.exe	84
PID 1664 wrote to memory of 4500	1664	svchost.exe	84
PID 1664 wrote to memory of 4500	1664	svchost.exe	84
PID 1664 wrote to memory of 4924	1664	svchost.exe	85
PID 1664 wrote to memory of 4924	1664	svchost.exe	85
PID 1664 wrote to memory of 4924	1664	svchost.exe	85
PID 1664 wrote to memory of 1252	1664	svchost.exe	94
PID 1664 wrote to memory of 1252	1664	svchost.exe	94
PID 1664 wrote to memory of 1252	1664	svchost.exe	94
PID 1664 wrote to memory of 4020	1664	svchost.exe	96
PID 1664 wrote to memory of 4020	1664	svchost.exe	96
PID 1664 wrote to memory of 4020	1664	svchost.exe	96

C:\Users\Admin\AppData\Local\Temp\8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe
"C:\Users\Admin\AppData\Local\Temp\8fa94bb51113e2a5d2575e317dc86647ff54c730f44334cfecad05317d7998fb.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2028
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4500
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:02 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4924
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1252
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
cff110260e90b8708ecb93afb5f65897

SHA1
988e8db97762bcdc3322f81d6c0ebd762e183255

SHA256
8761e2888b73aba0887953a5271b9d5bd7cf5c7c6bd45bb4e3db4b54b97ee619

SHA512
8d039db1220aff183d5e507aa3821760483b07e74fe3011a6167bf4771d3e29b58fae1c4b932c7a4fc6ac7417c4267e3d0d333189c3f353a9f6074119378f3a5

Download Submit
C:\Windows\System\explorer.exe

Filesize
207KB

MD5
a69bb0a1c6a74dcf31bc4d51e59a70ea

SHA1
c1076b48f825dbe5ecb9f644ca70044005b1d4c1

SHA256
2210efdf6df572fd7f67ca937a011e878bcc49b90e6b3dcaa0c37917502b8721

SHA512
3ef1bb920ce33755f560a47691dd927f773ebbde42d4e8c6fcac8a2eb3970054af3c75f0047a2ecce794157ea5f7a5cfe9bcd5a36df6a22ff0d2daa4b0691420

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
207KB

MD5
6af4fd43a2e4dd221091a6e6ef5b787c

SHA1
f657d58d79ce3f8adbfa27e06c73e4fe8e9e290d

SHA256
443832a306cbe27d2d996bd1be3d1aaa11c10061aebd9ef271fee09a71c7857b

SHA512
751b899be7531f0e3cef7d78c279aa0f5ed17bc7fedc456ecd17959b66367161678755a1f00c075fa50f60c9c8a756ed39c0c5eae914ae2e523fb8682f8168b1

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
207KB

MD5
6af4fd43a2e4dd221091a6e6ef5b787c

SHA1
f657d58d79ce3f8adbfa27e06c73e4fe8e9e290d

SHA256
443832a306cbe27d2d996bd1be3d1aaa11c10061aebd9ef271fee09a71c7857b

SHA512
751b899be7531f0e3cef7d78c279aa0f5ed17bc7fedc456ecd17959b66367161678755a1f00c075fa50f60c9c8a756ed39c0c5eae914ae2e523fb8682f8168b1

Download Submit
C:\Windows\System\svchost.exe

Filesize
206KB

MD5
2f5c875dc5f3321e08fb3aef72e8e22c

SHA1
cba0fb001073681f240eb2918300f1de08a98b2d

SHA256
8716cbdd92aecebff1f49814aaaf7d400c49a37c0a1a094aa7442ba037d80735

SHA512
a6705d243fc09681b0d3bca7436321c9280f132ca299350c849d9ab75c08dddf790439bd2f689d68eade1b8f5ec3d4767226acbe15e908fb3c4fb1dc0c74ab5b

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
207KB

MD5
a69bb0a1c6a74dcf31bc4d51e59a70ea

SHA1
c1076b48f825dbe5ecb9f644ca70044005b1d4c1

SHA256
2210efdf6df572fd7f67ca937a011e878bcc49b90e6b3dcaa0c37917502b8721

SHA512
3ef1bb920ce33755f560a47691dd927f773ebbde42d4e8c6fcac8a2eb3970054af3c75f0047a2ecce794157ea5f7a5cfe9bcd5a36df6a22ff0d2daa4b0691420

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
207KB

MD5
6af4fd43a2e4dd221091a6e6ef5b787c

SHA1
f657d58d79ce3f8adbfa27e06c73e4fe8e9e290d

SHA256
443832a306cbe27d2d996bd1be3d1aaa11c10061aebd9ef271fee09a71c7857b

SHA512
751b899be7531f0e3cef7d78c279aa0f5ed17bc7fedc456ecd17959b66367161678755a1f00c075fa50f60c9c8a756ed39c0c5eae914ae2e523fb8682f8168b1

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
2f5c875dc5f3321e08fb3aef72e8e22c

SHA1
cba0fb001073681f240eb2918300f1de08a98b2d

SHA256
8716cbdd92aecebff1f49814aaaf7d400c49a37c0a1a094aa7442ba037d80735

SHA512
a6705d243fc09681b0d3bca7436321c9280f132ca299350c849d9ab75c08dddf790439bd2f689d68eade1b8f5ec3d4767226acbe15e908fb3c4fb1dc0c74ab5b

Download Submit