9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe
Size

206KB
MD5

e197ebe7cf195c474fb9b5ca74dcc3e2
SHA1

1fc001d76228f22bd68e66a2c1e3c42ffde3d5ab
SHA256

9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0
SHA512

52daf207443bebee69b49199d338ac91e0cb7bb6b3f85b1ab1cf8371a8967255964d1f3cc9b4a0bbc20a2eed8f102a4097f5b25b751dfcb01c3559faa3e572d5
SSDEEP

3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unoy:zvEN2U+T6i5LirrllHy4HUcMQY6fy

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
1264	explorer.exe
2016	spoolsv.exe
4688	svchost.exe
392	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
828	9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe
828	9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe
1264	explorer.exe
1264	explorer.exe
4688	svchost.exe
4688	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4688	svchost.exe
1264	explorer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
828	9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe
828	9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe
1264	explorer.exe
1264	explorer.exe
2016	spoolsv.exe
2016	spoolsv.exe
4688	svchost.exe
4688	svchost.exe
392	spoolsv.exe
392	spoolsv.exe
1264	explorer.exe
1264	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1264	828	9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe	82
PID 828 wrote to memory of 1264	828	9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe	82
PID 828 wrote to memory of 1264	828	9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe	82
PID 1264 wrote to memory of 2016	1264	explorer.exe	83
PID 1264 wrote to memory of 2016	1264	explorer.exe	83
PID 1264 wrote to memory of 2016	1264	explorer.exe	83
PID 2016 wrote to memory of 4688	2016	spoolsv.exe	84
PID 2016 wrote to memory of 4688	2016	spoolsv.exe	84
PID 2016 wrote to memory of 4688	2016	spoolsv.exe	84
PID 4688 wrote to memory of 392	4688	svchost.exe	85
PID 4688 wrote to memory of 392	4688	svchost.exe	85
PID 4688 wrote to memory of 392	4688	svchost.exe	85
PID 4688 wrote to memory of 4848	4688	svchost.exe	86
PID 4688 wrote to memory of 4848	4688	svchost.exe	86
PID 4688 wrote to memory of 4848	4688	svchost.exe	86
PID 4688 wrote to memory of 3416	4688	svchost.exe	89
PID 4688 wrote to memory of 3416	4688	svchost.exe	89
PID 4688 wrote to memory of 3416	4688	svchost.exe	89
PID 4688 wrote to memory of 2944	4688	svchost.exe	97
PID 4688 wrote to memory of 2944	4688	svchost.exe	97
PID 4688 wrote to memory of 2944	4688	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe
"C:\Users\Admin\AppData\Local\Temp\9713d6197c93d74e74ec8b4ab7a064af9977edc376fe3c0dfd54a57f9e01cec0.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1264
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:392
    - - C:\Windows\SysWOW64\at.exe
        
        at 17:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4848
    - - C:\Windows\SysWOW64\at.exe
        
        at 17:36 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3416
    - - C:\Windows\SysWOW64\at.exe
        
        at 17:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
53302b21136b29b198a883fb41f093c9

SHA1
9c33bdda72656c6c09ac894e1730a7e79a9db89a

SHA256
468a2b9b5471cdfdc95355fa673d4cdbd3ae672c37b7e811711e8db401fc1758

SHA512
b3fae0425bc608b36856a649425a2d9f041148e6fb23f23764af11e0f9bc2da77f507581cbaf9aa10bd10a2dc9d0c20a4a8fc911369d6b5823bd1cfb3091b8af

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
10fca034a33755c0ccaa1d7b06f9aace

SHA1
46198c2c41b7a4fe3e1f54265596f29a8b96f6d6

SHA256
f7133528e755bcccf8a2bbda80763b4d5d273d0292fe68e8a4186204161c32bd

SHA512
f4562ef928d208865a1712df6c8a0e403f2def6923ce10382b67f19d897f6e7d759678f8a3076db898adc3e15f09dd82c29819d66ed82bc09a9cd95e2f5a3bbf

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
ff09a1970ee4944f841100cf8dcf1820

SHA1
2d0b35c8a7c08edb9bed4e2aeaf8f1c4ee941597

SHA256
c097c26fdda2c04484ef381c939cc94935b7fc37855d1f39d40e02f8f727204a

SHA512
ae3774b7d3f4ce7233c0b7a14d9b35ed961572bd2fad6304157956ec82f2fd656f2fbb985f03cd80d138567ecbdf0ec3be17e203ff7c866139c253b47ac2174f

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
ff09a1970ee4944f841100cf8dcf1820

SHA1
2d0b35c8a7c08edb9bed4e2aeaf8f1c4ee941597

SHA256
c097c26fdda2c04484ef381c939cc94935b7fc37855d1f39d40e02f8f727204a

SHA512
ae3774b7d3f4ce7233c0b7a14d9b35ed961572bd2fad6304157956ec82f2fd656f2fbb985f03cd80d138567ecbdf0ec3be17e203ff7c866139c253b47ac2174f

Download Submit
C:\Windows\System\svchost.exe

Filesize
206KB

MD5
68477cdfefc41a34abbd85f647f36160

SHA1
2e16313131c4b2e6a1c7fa776ee0328beaf12685

SHA256
4afef3be345b31fda014f84c8f1ac2cf957e13e1442e9b7aea7d31e4e13c9883

SHA512
aeb0b9153055bf899a398984b2ee38d4c8c1e9a22091e326de79010418a79a5d1afda7fc66307a007394b7c6d9f8b25d028665c308b1da6fdb6abdb8de109db4

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
10fca034a33755c0ccaa1d7b06f9aace

SHA1
46198c2c41b7a4fe3e1f54265596f29a8b96f6d6

SHA256
f7133528e755bcccf8a2bbda80763b4d5d273d0292fe68e8a4186204161c32bd

SHA512
f4562ef928d208865a1712df6c8a0e403f2def6923ce10382b67f19d897f6e7d759678f8a3076db898adc3e15f09dd82c29819d66ed82bc09a9cd95e2f5a3bbf

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
ff09a1970ee4944f841100cf8dcf1820

SHA1
2d0b35c8a7c08edb9bed4e2aeaf8f1c4ee941597

SHA256
c097c26fdda2c04484ef381c939cc94935b7fc37855d1f39d40e02f8f727204a

SHA512
ae3774b7d3f4ce7233c0b7a14d9b35ed961572bd2fad6304157956ec82f2fd656f2fbb985f03cd80d138567ecbdf0ec3be17e203ff7c866139c253b47ac2174f

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
68477cdfefc41a34abbd85f647f36160

SHA1
2e16313131c4b2e6a1c7fa776ee0328beaf12685

SHA256
4afef3be345b31fda014f84c8f1ac2cf957e13e1442e9b7aea7d31e4e13c9883

SHA512
aeb0b9153055bf899a398984b2ee38d4c8c1e9a22091e326de79010418a79a5d1afda7fc66307a007394b7c6d9f8b25d028665c308b1da6fdb6abdb8de109db4

Download Submit