3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe
Size

211KB
MD5

c51fc2f3b5baf94edd0a789e86064513
SHA1

e5bd7871977d8edb5374035ef4d6628cf9514889
SHA256

3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f
SHA512

2d6a8aae9161ebc43abcefcac70363f1dd4cfafd874117c52f2ff0c1dc5e28ac512cc6e70bb24c5d799939395e609ec05e26a526d02808b014388f73c97e637d
SSDEEP

3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqON:Jh8cBzHLRMpZ4d1ZN

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	swchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	userinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	swchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	userinit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4772	userinit.exe
2600	spoolsw.exe
3220	swchost.exe
4028	spoolsw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	swchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\system\udsys.exe	userinit.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\userinit.exe	3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe
File opened for modification	\??\c:\windows\spoolsw.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	spoolsw.exe
File opened for modification	\??\c:\windows\userinit.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	swchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1976	3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe
1976	3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe
4772	userinit.exe
4772	userinit.exe
4772	userinit.exe
4772	userinit.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe
4772	userinit.exe
4772	userinit.exe
3220	swchost.exe
3220	swchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4772	userinit.exe
3220	swchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1976	3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe
1976	3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe
4772	userinit.exe
4772	userinit.exe
2600	spoolsw.exe
2600	spoolsw.exe
3220	swchost.exe
3220	swchost.exe
4028	spoolsw.exe
4028	spoolsw.exe
4772	userinit.exe
4772	userinit.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4772	1976	3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe	87
PID 1976 wrote to memory of 4772	1976	3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe	87
PID 1976 wrote to memory of 4772	1976	3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe	87
PID 4772 wrote to memory of 2600	4772	userinit.exe	88
PID 4772 wrote to memory of 2600	4772	userinit.exe	88
PID 4772 wrote to memory of 2600	4772	userinit.exe	88
PID 2600 wrote to memory of 3220	2600	spoolsw.exe	89
PID 2600 wrote to memory of 3220	2600	spoolsw.exe	89
PID 2600 wrote to memory of 3220	2600	spoolsw.exe	89
PID 3220 wrote to memory of 4028	3220	swchost.exe	91
PID 3220 wrote to memory of 4028	3220	swchost.exe	91
PID 3220 wrote to memory of 4028	3220	swchost.exe	91

C:\Users\Admin\AppData\Local\Temp\3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe
"C:\Users\Admin\AppData\Local\Temp\3427a3de054f8448871f3b2f58ad33d0b5893b9483cdc43399dd3fa8befcc77f.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- \??\c:\windows\userinit.exe
  c:\windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4772
- - \??\c:\windows\spoolsw.exe
    c:\windows\spoolsw.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - \??\c:\windows\swchost.exe
      c:\windows\swchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3220
    - - \??\c:\windows\spoolsw.exe
        
        c:\windows\spoolsw.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mrsys.exe

Filesize
211KB

MD5
810d6979c30c4b6d94a68da259988645

SHA1
a54bd6a152d65bd73ecc8b5eb98cb94f44e14bb6

SHA256
a33a46e47f3af365f9fe5993ae0a61de640fb38f687b13f62d2b34685bfec42b

SHA512
5d32353d2759d4aa48bb86f229dcbafe9234b6ac0bad48db5506a5145ba14d3e07a0d7e1eede571c133aa4c411872dfef34fb9e6d37c1287019b1ba96c9142f5

Download Submit
C:\Windows\spoolsw.exe

Filesize
211KB

MD5
03d9a39fcfa905b1cc2032ba9536f074

SHA1
521606175b6935efd3c68a1569ca9fc5f1d52cd6

SHA256
e99be072a0edbaca488484a8e0761a2853d5c725a71741d98d6e34335817d5f1

SHA512
4f462aa4162df7b707471e4ad47af66b47732c7afdba376909d8880344562a91429d061de99d95f2c3dc9fde39d4a22c99c59ff428eccf47765bc87132aee1ec

Download Submit
C:\Windows\swchost.exe

Filesize
211KB

MD5
e993244420a7ebcb4ef1089df206be17

SHA1
cf8216b5794a63ca7d2d0a37104cf21bde5456e0

SHA256
5f8330acc12ef307e3b892d55771dd89e820ef86ca5533d32285652d330ef55a

SHA512
fd72f58cf6ae938e58951bed7b4bfb9c3403bcf79ff11616b2b66b240cb568b68b1915d7e045d20de546e77f1603d791120cfdad0ed8f4bd0691e006b0c4f1ef

Download Submit
C:\Windows\userinit.exe

Filesize
211KB

MD5
4ac07332861a8de64040c701cdbddc48

SHA1
938b1cd8555f9471d795f7238207716b2c987263

SHA256
710fd464d863c3fa456ff3e41d1488fcb87aa9ea40e470aadd15565342dc2653

SHA512
8618bb008e88ca663f4000aff0416f6572828bf168e873092e8a5fdbf5ee7d9773d6308a796c8ab7dae4d26633b72bf7804439769a73bbbf42813239de6eac7a

Download Submit