8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe
Size 216KB
Sample240425-af6wfaca55
SHA256 8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c
MD5 545ffe2bb81aebd9a6f51edd37af3cb1
SHA1 c583e621a8a7b934a21d9497e7006aa1b6e12c12
SHA512 377772cf8ea12b7c1f38a34c9b7e5b208a46d795b1ac08b79ca7acf7189cea3cdfba85a0fb526349d659a08fb6419fea3b5e7cc621acd294d16099058005334a
SSDEEP 3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uK2/pk:+vEN2U+T6i5LirrllHy4HUcMQY6BN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1688	explorer.exe
2416	spoolsv.exe
4984	svchost.exe
788	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3176	8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe
3176	8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe
4984	svchost.exe
4984	svchost.exe
1688	explorer.exe
1688	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1688	explorer.exe
4984	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3176	8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe
3176	8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe
1688	explorer.exe
1688	explorer.exe
2416	spoolsv.exe
2416	spoolsv.exe
4984	svchost.exe
4984	svchost.exe
788	spoolsv.exe
788	spoolsv.exe
1688	explorer.exe
1688	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 1688	3176	8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe	92
PID 3176 wrote to memory of 1688	3176	8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe	92
PID 3176 wrote to memory of 1688	3176	8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe	92
PID 1688 wrote to memory of 2416	1688	explorer.exe	93
PID 1688 wrote to memory of 2416	1688	explorer.exe	93
PID 1688 wrote to memory of 2416	1688	explorer.exe	93
PID 2416 wrote to memory of 4984	2416	spoolsv.exe	94
PID 2416 wrote to memory of 4984	2416	spoolsv.exe	94
PID 2416 wrote to memory of 4984	2416	spoolsv.exe	94
PID 4984 wrote to memory of 788	4984	svchost.exe	95
PID 4984 wrote to memory of 788	4984	svchost.exe	95
PID 4984 wrote to memory of 788	4984	svchost.exe	95
PID 4984 wrote to memory of 732	4984	svchost.exe	96
PID 4984 wrote to memory of 732	4984	svchost.exe	96
PID 4984 wrote to memory of 732	4984	svchost.exe	96
PID 4984 wrote to memory of 2664	4984	svchost.exe	107
PID 4984 wrote to memory of 2664	4984	svchost.exe	107
PID 4984 wrote to memory of 2664	4984	svchost.exe	107
PID 4984 wrote to memory of 3680	4984	svchost.exe	109
PID 4984 wrote to memory of 3680	4984	svchost.exe	109
PID 4984 wrote to memory of 3680	4984	svchost.exe	109

C:\Users\Admin\AppData\Local\Temp\8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe
"C:\Users\Admin\AppData\Local\Temp\8a824ee272512a00d8658ac8f46127e8ebbfc9b7d066f7cce36f3409acd43a3c.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1688
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:788
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:732
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2664
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3748 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 216KB
SHA256 b00fd474cd6247c6a7a23fa3a17feb51e97c5417b79e221c6495d9c558fd5400
MD5 3be4256279f9c7487aed515d9c9974c8
SHA1 406032dfb34359b7d4bd044a4a737b593570bbfd
SHA512 b6ba5d70367a1d6e7d5c1910ae8bf81a1275564c8a2fd87e32a721c58cb25059f603ded084f1d2755fbdca66c28fbc4dc73bbbd160735e8b4a55ab2915199c44
SSDEEP 3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uK2/pz:+vEN2U+T6i5LirrllHy4HUcMQY6BS
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 216KB
SHA256 0035a15ebccb579313374e9d2976351f1eb69331f9420a7ba0f1697ab73fc84c
MD5 cd719da98550535b55894636500b1eac
SHA1 f0f76160212c1a4d458b72fb47605232a56af232
SHA512 3217ce32dc4c72d56eab658661049be60effe978e8d6996ef07788661952dca7cfef3dee864ea731835a13ecee231fc7960043d1625941c9ec2663f2ac548618
SSDEEP 3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uK2/pFnnnnnnnnnnnnnnnnnnh:+vEN2U+T6i5LirrllHy4HUcMQY6Be
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 216KB
SHA256 167c595e997d15065fb36503370ed26edf52b15a2c87436ab9321a4e4a165a48
MD5 72e43f6e293819d7c417d622759b7342
SHA1 f094d86e83a44f09d998633ef8d40bab0d46b95a
SHA512 e8bcd009317d59f7afa935a10b4f6ad59f98bab22c1d4fd371fa9eaebd783ae700dc78027c540b61f084eb5fe97d81fffa1d57b1c83dd7d6e74fa9f8af35794b
SSDEEP 6144:+vEN2U+T6i5LirrllHy4HUcMQY6BUZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZu:AENN+T5xYrllrU7QY6X
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 216KB
SHA256 452eb9bc61394b2c931cae87e86696a4a285b27629f9862eb92271511db728f4
MD5 4f72e6de0c994c0346707facdc839a2f
SHA1 d04b14765a4bbe1efd0e21238dea4e64aadba48d
SHA512 1371f9a34201cdfd8905765fdfafa4c0b524f97e1bb76f37671afdb39a8ee5237531706b70cd944cf2e4b5794de4ec0d29e452f045d07bfacb1d944c9b2861b3
SSDEEP 3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uK2/pB:+vEN2U+T6i5LirrllHy4HUcMQY6Bo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/788-32-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2416-36-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3176-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3176-35-0x0000000000400000-0x0000000000431000-memory.dmp

Download