Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 05:14
Static task
static1
Behavioral task
behavioral1
Sample
f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe
Resource
win10v2004-20240412-en
General
-
Target
f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe
-
Size
211KB
-
MD5
b72f39fb4d2cb748d64e5e09b6c2a0ce
-
SHA1
3c57a579b7dc5ea0cca5adad75c6b0ff6bae2319
-
SHA256
f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7
-
SHA512
198466259fea805c5f69f8c24af02cb7cdbc16818391dd010afecae9c949692d669b1c2ca112227fb873e38ec7dfeec6e62a92f1cd6a6a174eaa2678f750b0ae
-
SSDEEP
3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOj:Jh8cBzHLRMpZ4d1Zj
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
swchost.exeuserinit.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" userinit.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
userinit.exeswchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" userinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" swchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
Processes:
userinit.exeswchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" userinit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} userinit.exe -
Executes dropped EXE 4 IoCs
Processes:
userinit.exespoolsw.exeswchost.exespoolsw.exepid process 648 userinit.exe 4720 spoolsw.exe 2832 swchost.exe 456 spoolsw.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
userinit.exeswchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" swchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
userinit.exedescription ioc process File opened for modification C:\Windows\SysWOW64\system\udsys.exe userinit.exe -
Drops file in Windows directory 5 IoCs
Processes:
swchost.exef52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exeuserinit.exespoolsw.exedescription ioc process File opened for modification \??\c:\windows\swchost.exe swchost.exe File opened for modification \??\c:\windows\userinit.exe f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe File opened for modification \??\c:\windows\spoolsw.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe spoolsw.exe File opened for modification \??\c:\windows\userinit.exe userinit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exeuserinit.exeswchost.exepid process 208 f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe 208 f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe 648 userinit.exe 648 userinit.exe 648 userinit.exe 648 userinit.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe 648 userinit.exe 648 userinit.exe 2832 swchost.exe 2832 swchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
swchost.exeuserinit.exepid process 2832 swchost.exe 648 userinit.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exeuserinit.exespoolsw.exeswchost.exespoolsw.exepid process 208 f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe 208 f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe 648 userinit.exe 648 userinit.exe 4720 spoolsw.exe 4720 spoolsw.exe 2832 swchost.exe 2832 swchost.exe 456 spoolsw.exe 456 spoolsw.exe 648 userinit.exe 648 userinit.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exeuserinit.exespoolsw.exeswchost.exedescription pid process target process PID 208 wrote to memory of 648 208 f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe userinit.exe PID 208 wrote to memory of 648 208 f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe userinit.exe PID 208 wrote to memory of 648 208 f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe userinit.exe PID 648 wrote to memory of 4720 648 userinit.exe spoolsw.exe PID 648 wrote to memory of 4720 648 userinit.exe spoolsw.exe PID 648 wrote to memory of 4720 648 userinit.exe spoolsw.exe PID 4720 wrote to memory of 2832 4720 spoolsw.exe swchost.exe PID 4720 wrote to memory of 2832 4720 spoolsw.exe swchost.exe PID 4720 wrote to memory of 2832 4720 spoolsw.exe swchost.exe PID 2832 wrote to memory of 456 2832 swchost.exe spoolsw.exe PID 2832 wrote to memory of 456 2832 swchost.exe spoolsw.exe PID 2832 wrote to memory of 456 2832 swchost.exe spoolsw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe"C:\Users\Admin\AppData\Local\Temp\f52446659cb366fbf03b3a77f640bb9b7ccad5f3b973da705a126c411c50eff7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\windows\userinit.exec:\windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\windows\swchost.exec:\windows\swchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:456
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\mrsys.exeFilesize
211KB
MD5881e29a6980c2a6199b5e6dc2613cd55
SHA1e20c00f3c12f2430459cd8ae89a3ec505195c2d0
SHA256914277039e07af5fc8f73f5e402e1bf35d159915ec70d17e2afc068d9d073320
SHA5122df576806b57e385d6fb3aa881414ba2e65c708128862f7ea67d5d01adc8e878f516c9a060404755fad544e87d34f20b1c2ee5eff3e851d25d1370f4c54cf1f6
-
C:\Windows\spoolsw.exeFilesize
211KB
MD5cad8c47429cb2d47ba02edba287236c6
SHA1bf76133ca4fd3d6554aa664125ceeaef6dbe5e35
SHA256caeb55dc7f2d86c9de2ac345bf724debef5f1dc335b70363b71d4e27d742239b
SHA512d9b3fd4f7a1e01d0fbc09a8170df8e04bbee1b34ea273609619432054e3e2dabee0b7704468a28ac68af179e3184aedb625003fe539a3410de4fbdac805ac6f6
-
C:\Windows\swchost.exeFilesize
211KB
MD5bda10a6d6413cc7dcead08e316fc07d1
SHA15886c8c3320c914e93fb9103448bba45ee8bc6de
SHA256b4b387e96f32c066e3fbe8039df97d699dc30aa8b5dd96f1d5c4414927a8e967
SHA5120a2624b5cc90576458400dbb365243cf6680bc7dcd6eda0eaf8f91e84e8e855d2a098242e5d13d1058452e36bf5c1f1b42b8d3a3c10b19c3fc779e9f6b4fa4bb
-
C:\Windows\userinit.exeFilesize
211KB
MD56a80c1531d8654c4e891108ad10773e9
SHA1ce5ae4233675b1ddfb0c541d5c8edd7bb2c3ca8f
SHA256129ca9216c21c4abbe52cf79c410dd118eee6bc56602c437e7b6bab7a88c3483
SHA512e59b5d0881ff23b17d432420b70b5fff96836a2e064c85e46b332117dfdc5fec6973682857685b2a58294ccc462373817facaa79190994725ef27cffb61021f4