Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe
- Size 206KB
- Sample240404-23lybsdf86
- SHA256 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c
- MD5 5492018432c670f000494780ec4fcb9b
- SHA1 7faac63e3646f754a0a127228705b6170eafcc20
- SHA512 4f0bbfecffe50dbbc6652f6a99c572ebf67dac4261976e3aa5e47dc4381ee8a99ede4f0986912f7e418369ef9d60a63f4b5aafbee71c19b691007333d8161c74
- SSDEEP 3072:gvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unrm:gvEN2U+T6i5LirrllHy4HUcMQY6sm
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe - Executes dropped EXE 4 IoCs
pid Process 1464 explorer.exe 3908 spoolsv.exe 3028 svchost.exe 4084 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4580 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe 4580 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe 1464 explorer.exe 1464 explorer.exe 1464 explorer.exe 1464 explorer.exe 1464 explorer.exe 1464 explorer.exe 1464 explorer.exe 1464 explorer.exe 3028 svchost.exe 3028 svchost.exe 3028 svchost.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 3028 svchost.exe 3028 svchost.exe 1464 explorer.exe 1464 explorer.exe 3028 svchost.exe 3028 svchost.exe 1464 explorer.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 1464 explorer.exe 3028 svchost.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 1464 explorer.exe 1464 explorer.exe 3028 svchost.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 3028 svchost.exe 1464 explorer.exe 1464 explorer.exe 1464 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1464 explorer.exe 3028 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4580 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe 4580 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe 1464 explorer.exe 1464 explorer.exe 3908 spoolsv.exe 3908 spoolsv.exe 3028 svchost.exe 3028 svchost.exe 4084 spoolsv.exe 4084 spoolsv.exe 1464 explorer.exe 1464 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4580 wrote to memory of 1464 4580 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe 86 PID 4580 wrote to memory of 1464 4580 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe 86 PID 4580 wrote to memory of 1464 4580 9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe 86 PID 1464 wrote to memory of 3908 1464 explorer.exe 87 PID 1464 wrote to memory of 3908 1464 explorer.exe 87 PID 1464 wrote to memory of 3908 1464 explorer.exe 87 PID 3908 wrote to memory of 3028 3908 spoolsv.exe 89 PID 3908 wrote to memory of 3028 3908 spoolsv.exe 89 PID 3908 wrote to memory of 3028 3908 spoolsv.exe 89 PID 3028 wrote to memory of 4084 3028 svchost.exe 90 PID 3028 wrote to memory of 4084 3028 svchost.exe 90 PID 3028 wrote to memory of 4084 3028 svchost.exe 90 PID 3028 wrote to memory of 1020 3028 svchost.exe 91 PID 3028 wrote to memory of 1020 3028 svchost.exe 91 PID 3028 wrote to memory of 1020 3028 svchost.exe 91 PID 3028 wrote to memory of 4212 3028 svchost.exe 103 PID 3028 wrote to memory of 4212 3028 svchost.exe 103 PID 3028 wrote to memory of 4212 3028 svchost.exe 103 PID 3028 wrote to memory of 4000 3028 svchost.exe 105 PID 3028 wrote to memory of 4000 3028 svchost.exe 105 PID 3028 wrote to memory of 4000 3028 svchost.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe"C:\Users\Admin\AppData\Local\Temp\9507429d0cb32ad5bcac3a4d48d4ddfd2803b7d5611df5affd327094e78f124c.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4084
-
-
C:\Windows\SysWOW64\at.exeat 23:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1020
-
-
C:\Windows\SysWOW64\at.exeat 23:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4212
-
-
C:\Windows\SysWOW64\at.exeat 23:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4000
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 646aea82cf2ed9b3d9159f60bb2436c9c1486214e45b9eb8cd62e25fa4139d1d
- MD5 34b961999931dbde3d60a48ae5f6d87b
- SHA1 5a69f07a814c66494aa21df42a88a84606d185f7
- SHA512 0f602be963f9dfffd604a74589f86e5aec4f1000d085fce74335db45c65d5c23754e0a5279dea80ca5318d53872e65933706d7e5bfe87e8756e78793d1def2bd
- SSDEEP 3072:gvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unr3:gvEN2U+T6i5LirrllHy4HUcMQY6s3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 0ca0ef9822a64b67724f3652cc2cd08168bd3dade1c3a121d9d90094a300742d
- MD5 07b495f1d42b6c9a3f3b64803c15bb76
- SHA1 dfc8e9d0885ed71bedd8d43decc69210f2656dc5
- SHA512 563b7a3fa9e5b8c052e9baf95b4139f8c60f220be8933c47b5ba3fdf03bdef25d61bffc6c3e4618036cd125aa90e5e6deec82d4c7291f0d5c028bde76dba579b
- SSDEEP 3072:gvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unrt:gvEN2U+T6i5LirrllHy4HUcMQY6st
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 26a366f2bbd7a3494183fa687ffc27bccdd3c6f200c3a1d800f29bdf14cae814
- MD5 a86da7298512692de2e4076900ad079a
- SHA1 56075445e4192aea68a7c3df8fc177206447a56b
- SHA512 56ccc1c144a35330ed275350b209971d87175d20915081b0ac9e2b6013da79a5466c0fe42d8a6d4421372462e50449080a5e05af7a4a32a75872e491065cd7e1
- SSDEEP 3072:gvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unrb:gvEN2U+T6i5LirrllHy4HUcMQY6sb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 44017a2e7c721ad6fcba246e81d7c8228cbff9ebcf27c3b4350002936b5b7e85
- MD5 80bad15d2483a2ff36f783cfcee20d12
- SHA1 31c7d5bb4e12fddf343b03cad11477fea348fd01
- SHA512 840466856a862b70061b5427ad4e0ca6c260e1068a189552d4f5f6e18d037ecb2bf6faaae011a8a4595c3c004aaef6597ad81bbeec51eb1fd29ab014161eec50
- SSDEEP 3072:gvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unrE:gvEN2U+T6i5LirrllHy4HUcMQY6sE
- MD5 SHA1 SHA512 SSDEEP