Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe
Resource
win10v2004-20240419-en
General
-
Target
dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe
-
Size
211KB
-
MD5
4d6f250bb8d011ade5678301ef60d3d4
-
SHA1
07c2ef14f490767bf938bd9bce997f3384da3be4
-
SHA256
dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef
-
SHA512
52fce216b88e3089e57633f83c409abecf596d6ea126129be7136630503ee8e86250389a53bbc00e524c191ca0339faba895020e48f47b3b95c5b605d5ff183a
-
SSDEEP
3072:WD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqO4:Wh8cBzHLRMpZ4d1Z4
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" swchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" userinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" swchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" userinit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe -
Executes dropped EXE 4 IoCs
pid Process 4708 userinit.exe 1404 spoolsw.exe 4456 swchost.exe 2600 spoolsw.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" swchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\system\udsys.exe userinit.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\userinit.exe dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe File opened for modification \??\c:\windows\spoolsw.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe spoolsw.exe File opened for modification \??\c:\windows\userinit.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe swchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2864 dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe 2864 dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe 4708 userinit.exe 4708 userinit.exe 4708 userinit.exe 4708 userinit.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe 4708 userinit.exe 4708 userinit.exe 4456 swchost.exe 4456 swchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4708 userinit.exe 4456 swchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2864 dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe 2864 dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe 4708 userinit.exe 4708 userinit.exe 1404 spoolsw.exe 1404 spoolsw.exe 4456 swchost.exe 4456 swchost.exe 2600 spoolsw.exe 2600 spoolsw.exe 4708 userinit.exe 4708 userinit.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2864 wrote to memory of 4708 2864 dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe 84 PID 2864 wrote to memory of 4708 2864 dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe 84 PID 2864 wrote to memory of 4708 2864 dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe 84 PID 4708 wrote to memory of 1404 4708 userinit.exe 85 PID 4708 wrote to memory of 1404 4708 userinit.exe 85 PID 4708 wrote to memory of 1404 4708 userinit.exe 85 PID 1404 wrote to memory of 4456 1404 spoolsw.exe 86 PID 1404 wrote to memory of 4456 1404 spoolsw.exe 86 PID 1404 wrote to memory of 4456 1404 spoolsw.exe 86 PID 4456 wrote to memory of 2600 4456 swchost.exe 87 PID 4456 wrote to memory of 2600 4456 swchost.exe 87 PID 4456 wrote to memory of 2600 4456 swchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe"C:\Users\Admin\AppData\Local\Temp\dffce7fe5a998086d3e8e70c395ca9bbaa966b7ac74383e9de38c39732ab6cef.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\windows\userinit.exec:\windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\windows\swchost.exec:\windows\swchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2600
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5c23a826a8d7a8f07b4ae94898b69180e
SHA1ff86fbd5245f55c57b7109e4287a2fe219f87153
SHA256322984949a75ea83f363c7bb4bee44e44dc4ee5b92999288c720e167136893a1
SHA512f05b803427cb9b9d9e37a98ff9fb762863bf2386f8b090057c64ba44c083d5152c81c3700a5e9a20964f97ccb595faf27697306a578fc9c6fc235f4b4c6bc889
-
Filesize
211KB
MD5bc1c177c058579cb29417e4487f636d5
SHA1c5b7bbb49af81b78fba29b33a446f3c69ce56779
SHA256bcfdc8a78621f6458da8358317e5d81d21a29931f9af32ed6b081edc136eebfa
SHA512fc0754253a83f69b0a68ee8e99b9376f2c736dd012a5140b28bce34a132a46538f350b56268415bce5bb2a95dc9b349abfa0e42d0875b419f85a8fb953ab4590
-
Filesize
211KB
MD53d9d4bf629c36eba2c946b197f95805d
SHA1f74d464838891442ac277a03a11b62892661d95a
SHA25657a943a88d0461a4133ef11855da523ad9436591cb4a6933e4a86e94d4337abb
SHA5127e5cdaf43731705f00fd68caa311e62a94c23089207dca0d184685706f37608144645ecabfafed6b2ff2b8345a67a2d0f546c7eb7635059a45843cc2593b4caa
-
Filesize
211KB
MD541d2ebfea9b1c884b33cad5896911a59
SHA1041c74d9ca68a9dae184c0a776f1a57b940a19e2
SHA2563a8a0c9237f890cce519505b1fa7a98f00f3d2374eda007c24a018bc85ea1fc4
SHA51260c344069611939c756570bfa5321c1cccf7a8282516071f5206fadf45b2009b0ad773b72a7af6596c425e790b6e4c2d749a0558cac134466c52dbeaaaa88d02