5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
Size

211KB
MD5

6b2e5a2bf4036c3ffa44573cf402952f
SHA1

324211705a5167abab90d39b2eca7279836891d9
SHA256

5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea
SHA512

2be1d9e476496b37033fc5840f5bba3900f9f7da6e476c6291806dc26d0b635141b95d2764f30f1732043cf3a4fbedace945b3c8a87fb4c70f36aee032fa3e70
SSDEEP

3072:dDEPeJlYW1ea8HKHSRUN3jjXs9Y+MiMVB/w68PEAjAfIrAvGPZz6sPJBIiFe/Gcu:dSAl1IK1aY+MiMVBSeI

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	swchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	swchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	userinit.exe

Modifies Installed Components in the registry 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	userinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2592	userinit.exe
2400	spoolsw.exe
2420	swchost.exe
2448	spoolsw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	swchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\udsys.exe	userinit.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\userinit.exe	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
File opened for modification	\??\c:\windows\spoolsw.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	spoolsw.exe
File opened for modification	\??\c:\windows\userinit.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	swchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2476	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
2592	userinit.exe
2420	swchost.exe
2420	swchost.exe
2592	userinit.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe
2420	swchost.exe
2592	userinit.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2420	swchost.exe
2592	userinit.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2476	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
2476	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
2592	userinit.exe
2592	userinit.exe
2400	spoolsw.exe
2400	spoolsw.exe
2420	swchost.exe
2420	swchost.exe
2448	spoolsw.exe
2448	spoolsw.exe
2592	userinit.exe
2592	userinit.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2592	2476	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe	29
PID 2476 wrote to memory of 2592	2476	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe	29
PID 2476 wrote to memory of 2592	2476	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe	29
PID 2476 wrote to memory of 2592	2476	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe	29
PID 2592 wrote to memory of 2400	2592	userinit.exe	30
PID 2592 wrote to memory of 2400	2592	userinit.exe	30
PID 2592 wrote to memory of 2400	2592	userinit.exe	30
PID 2592 wrote to memory of 2400	2592	userinit.exe	30
PID 2400 wrote to memory of 2420	2400	spoolsw.exe	31
PID 2400 wrote to memory of 2420	2400	spoolsw.exe	31
PID 2400 wrote to memory of 2420	2400	spoolsw.exe	31
PID 2400 wrote to memory of 2420	2400	spoolsw.exe	31
PID 2420 wrote to memory of 2448	2420	swchost.exe	32
PID 2420 wrote to memory of 2448	2420	swchost.exe	32
PID 2420 wrote to memory of 2448	2420	swchost.exe	32
PID 2420 wrote to memory of 2448	2420	swchost.exe	32

C:\Users\Admin\AppData\Local\Temp\5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
"C:\Users\Admin\AppData\Local\Temp\5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- \??\c:\windows\userinit.exe
  c:\windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2592
- - \??\c:\windows\spoolsw.exe
    c:\windows\spoolsw.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - \??\c:\windows\swchost.exe
      c:\windows\swchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2420
    - - \??\c:\windows\spoolsw.exe
        
        c:\windows\spoolsw.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mrsys.exe

Filesize
211KB

MD5
6f79e12ddd3da3c893b3771092d9dba1

SHA1
9b08a5d9012967abd83eb9dd11ee9adf46f513dd

SHA256
799fcccb74aeccbd8f5c9bd6b304f4b200ac4e13bab628ac78a9667af5773cc5

SHA512
c2ef8070450b7e8a57860dad7c74b9bb211de6018a8692ac842111bc56dfb39a54e71401c51c8191ca6bf02d41d82afbc2ea57c225700fb7323413a441c56f67

Download Submit
C:\Windows\spoolsw.exe

Filesize
211KB

MD5
8f5866b637da7409069a5dd8aa23c4c0

SHA1
9e6792bc5acaceb354f3e07370b91b83944ae5c1

SHA256
88b41992ceb936dff0950e8b138fe707205f67b051f4d5e8e82592b8c36793d2

SHA512
726fd85fac47f4e5270be68f39041fe771a2cc784b09f080a26903cf7fdb8c7257d5f799db6276f5019d8f65c63bdcb9a86abc9bc699242cefde6ad7b29af4fe

Download Submit
C:\Windows\swchost.exe

Filesize
211KB

MD5
25800b0f38153934fb12083d69b2d1c0

SHA1
cc64cfff4d5b85f928fb96f8ab8c19aec74014a5

SHA256
627e775fda03c4c701b61be02c9fbc29a37c1ee36cc91fe2caf5b8665e121366

SHA512
b602302884fa5f09f487888edb644725e6767c92b01be51c19e8e9ca728e66c116186c6cce906a2e31b7facf61d74dc2e9987b9e26e1fb3e70292310c31cfd97

Download Submit
C:\Windows\userinit.exe

Filesize
211KB

MD5
0f104bdd285d726a45387417d1fb7aa6

SHA1
35b00920cce10da242e3eb6f50563cd9c1a48295

SHA256
e01836e4edc7fa2e7080c642d2dbb7156959293c0e120a387d72c2616c873eaa

SHA512
63ec587bd3aa7852f299ba9c035355753d60a4f1e5318131c35d49aa857d6ef7742a848d095676b09cf65ffc1bdaacccf0d838586f386145867aa8d1f2875c60

Download Submit
memory/2400-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2400-45-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2448-42-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2448-44-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2476-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2476-11-0x00000000034F0000-0x0000000003532000-memory.dmp

Filesize
264KB

Download
memory/2476-54-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download