d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe
Size

66KB
MD5

79566a1c23d7399ce2d4cb6172a753ce
SHA1

4f007c19c14cca656c5a814a1d2c65349bc2be80
SHA256

d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a
SHA512

0765258ac8c1510722d4169251e94cc7c845c69060c9621827b76595899c9832d7840fdd7c3c4cbf95ad469733bfd904b30e82f6808bd1314283af68ff2f9071
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiY:IeklMMYJhqezw/pXzH9iY

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2616	explorer.exe
2564	spoolsv.exe
2512	svchost.exe
2496	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1692	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe
1692	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe
2616	explorer.exe
2616	explorer.exe
2564	spoolsv.exe
2564	spoolsv.exe
2512	svchost.exe
2512	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1692	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2512	svchost.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2512	svchost.exe
2616	explorer.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe
2616	explorer.exe
2512	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2616	explorer.exe
2512	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1692	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe
1692	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe
2616	explorer.exe
2616	explorer.exe
2564	spoolsv.exe
2564	spoolsv.exe
2512	svchost.exe
2512	svchost.exe
2496	spoolsv.exe
2496	spoolsv.exe
2616	explorer.exe
2616	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2616	1692	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe	28
PID 1692 wrote to memory of 2616	1692	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe	28
PID 1692 wrote to memory of 2616	1692	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe	28
PID 1692 wrote to memory of 2616	1692	d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe	28
PID 2616 wrote to memory of 2564	2616	explorer.exe	29
PID 2616 wrote to memory of 2564	2616	explorer.exe	29
PID 2616 wrote to memory of 2564	2616	explorer.exe	29
PID 2616 wrote to memory of 2564	2616	explorer.exe	29
PID 2564 wrote to memory of 2512	2564	spoolsv.exe	30
PID 2564 wrote to memory of 2512	2564	spoolsv.exe	30
PID 2564 wrote to memory of 2512	2564	spoolsv.exe	30
PID 2564 wrote to memory of 2512	2564	spoolsv.exe	30
PID 2512 wrote to memory of 2496	2512	svchost.exe	31
PID 2512 wrote to memory of 2496	2512	svchost.exe	31
PID 2512 wrote to memory of 2496	2512	svchost.exe	31
PID 2512 wrote to memory of 2496	2512	svchost.exe	31
PID 2512 wrote to memory of 3052	2512	svchost.exe	32
PID 2512 wrote to memory of 3052	2512	svchost.exe	32
PID 2512 wrote to memory of 3052	2512	svchost.exe	32
PID 2512 wrote to memory of 3052	2512	svchost.exe	32
PID 2512 wrote to memory of 2656	2512	svchost.exe	36
PID 2512 wrote to memory of 2656	2512	svchost.exe	36
PID 2512 wrote to memory of 2656	2512	svchost.exe	36
PID 2512 wrote to memory of 2656	2512	svchost.exe	36
PID 2512 wrote to memory of 1668	2512	svchost.exe	38
PID 2512 wrote to memory of 1668	2512	svchost.exe	38
PID 2512 wrote to memory of 1668	2512	svchost.exe	38
PID 2512 wrote to memory of 1668	2512	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe
"C:\Users\Admin\AppData\Local\Temp\d2aefc636b6db18278187345fb5bf1e898c2edae0d0edb35cb4e736ac434ad7a.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2616
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3052
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2656
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
9053305e77d8cf88bdf17f53972d927b

SHA1
0da68b4db87dd68905e0d5f3ee5069eb834f798a

SHA256
e608004c3b041ef543cb2f13dc355f57afbd160213243c4666b958e9b5d7a172

SHA512
0f4b686fee326b41a5554d5081a98fa767a51e3e06268c841d013ee3c323dfa3c5ee9cbf5e9484fde481af8c9bdeaac657edcbea64df45370ea2f00c11cc5b66

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
12d9b265d6967f34c1504cb8824378d1

SHA1
184288bae9dafa6867624333e468e0196f598c2e

SHA256
b2b05f78e36911c914bcb34a4855b8d9fedd53ea4ce3893977028c8968628bef

SHA512
9d2d20eec8fc2e51eb6459115707c73b2335fc7981edc130d395855c3be872fbbc34fd93c76aa9ff265ec737e0902ffd88558b38081373eba0c3a91e4e8e7fb1

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
dd5023e85616473aa26d642eb82e3e63

SHA1
54e22deea5decf1257338070199f43537f896441

SHA256
cd1390d78c9084245b5fe91f4f9c8227358b3c84b1a4e3d1f7645efd2649bbf8

SHA512
e94c5ac086948705f9d2f1be1528b2ee930446f8267d65384308d1128063bff4ad577d4bf0fe94542eae877a48f2b33740f18a73242b05f2bd704c6b6b4e50bb

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
b0fbe841d2ce904bb4bd94d0a4bd2de2

SHA1
19aa4684eac6725bb931c9e9b6f891c2c4ddf5c8

SHA256
16e361a37fe503f26c737b2545ce2b80d8dce4d45b913ce165b60b5cb9a292dd

SHA512
a635fcee3b43044a7ba728941d8c05c5435faf7a6f8291a7cf44c3120f8a058c947ac9a9a9ee1ceefc77d005680b9b09f49454e2b41727fbb0387cb94e89af67

Download Submit
memory/1692-56-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1692-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1692-17-0x0000000000440000-0x0000000000471000-memory.dmp

Filesize
196KB

Download
memory/1692-50-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1692-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1692-6-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1692-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1692-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1692-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1692-76-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2496-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2496-64-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2512-52-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2512-63-0x0000000002800000-0x0000000002831000-memory.dmp

Filesize
196KB

Download
memory/2512-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-51-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-35-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2564-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2616-90-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download