5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
Size

211KB
MD5

6b2e5a2bf4036c3ffa44573cf402952f
SHA1

324211705a5167abab90d39b2eca7279836891d9
SHA256

5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea
SHA512

2be1d9e476496b37033fc5840f5bba3900f9f7da6e476c6291806dc26d0b635141b95d2764f30f1732043cf3a4fbedace945b3c8a87fb4c70f36aee032fa3e70
SSDEEP

3072:dDEPeJlYW1ea8HKHSRUN3jjXs9Y+MiMVB/w68PEAjAfIrAvGPZz6sPJBIiFe/Gcu:dSAl1IK1aY+MiMVBSeI

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	swchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	swchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	userinit.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	userinit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3592	userinit.exe
2536	spoolsw.exe
4884	swchost.exe
2180	spoolsw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	swchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\udsys.exe	userinit.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\swchost.exe	swchost.exe
File opened for modification	\??\c:\windows\userinit.exe	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
File opened for modification	\??\c:\windows\spoolsw.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	spoolsw.exe
File opened for modification	\??\c:\windows\userinit.exe	userinit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4116	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
4116	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
3592	userinit.exe
3592	userinit.exe
3592	userinit.exe
3592	userinit.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe
3592	userinit.exe
3592	userinit.exe
4884	swchost.exe
4884	swchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3592	userinit.exe
4884	swchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4116	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
4116	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
3592	userinit.exe
3592	userinit.exe
2536	spoolsw.exe
2536	spoolsw.exe
4884	swchost.exe
4884	swchost.exe
2180	spoolsw.exe
2180	spoolsw.exe
3592	userinit.exe
3592	userinit.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3592	4116	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe	83
PID 4116 wrote to memory of 3592	4116	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe	83
PID 4116 wrote to memory of 3592	4116	5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe	83
PID 3592 wrote to memory of 2536	3592	userinit.exe	84
PID 3592 wrote to memory of 2536	3592	userinit.exe	84
PID 3592 wrote to memory of 2536	3592	userinit.exe	84
PID 2536 wrote to memory of 4884	2536	spoolsw.exe	85
PID 2536 wrote to memory of 4884	2536	spoolsw.exe	85
PID 2536 wrote to memory of 4884	2536	spoolsw.exe	85
PID 4884 wrote to memory of 2180	4884	swchost.exe	87
PID 4884 wrote to memory of 2180	4884	swchost.exe	87
PID 4884 wrote to memory of 2180	4884	swchost.exe	87

C:\Users\Admin\AppData\Local\Temp\5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
"C:\Users\Admin\AppData\Local\Temp\5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116
- \??\c:\windows\userinit.exe
  c:\windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3592
- - \??\c:\windows\spoolsw.exe
    c:\windows\spoolsw.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - \??\c:\windows\swchost.exe
      c:\windows\swchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4884
    - - \??\c:\windows\spoolsw.exe
        
        c:\windows\spoolsw.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mrsys.exe

Filesize
211KB

MD5
39f8424cf70d4ebd6a762c5b8d3dc3e8

SHA1
4065c6f2a1d11f016d458e325a65ae7e8ef87f34

SHA256
5fd29aaf0ff5fa5c7d4435d1a7748d0a050d7b36221f39eb8482f051c75a8c84

SHA512
2d220f088dcbfc289601f057b02a4db66fb2f143be4d6a22e7b85dd4518970d8d23c1b7c43da35f8986c9a96e8237f36c743b81b0ae7aa42933cd0c4bd0415e1

Download Submit
C:\Windows\spoolsw.exe

Filesize
211KB

MD5
dd8dc3f1bfa0880585eb19b7f0465b89

SHA1
8a44ed2023108740f121925b47d4c4a2de297cd3

SHA256
68eedf6936287c916d7f356c1f9aa53a71765f8cd4ec680b38f617a08f42350c

SHA512
6d75aa0f4cc27bda80c9c31e8c2276eb92adfa0f54530c42e9820b81fb03fd0bde363c90d3624971009e2528d56446bb7eabd32bc00e024d10194b690c7d689a

Download Submit
C:\Windows\swchost.exe

Filesize
211KB

MD5
6707274dc630dbf572c3e7a47b0b26e0

SHA1
6bd21584f323ea7ddbe3c6197101e91d47a03d7e

SHA256
b5291776b04d2dff0a07f97e95793fd29ae9b6c5272e42f94685f80f77503885

SHA512
6efcde68ce88fcbfe0262c10bbf328f7903c9c6cf7b2055d2aae4e6a7cd402c9aa09fb2509efc5caf1ddd3d223bce9a54d91d1da3b6dec6f6e3f8ac906d6c61b

Download Submit
C:\Windows\userinit.exe

Filesize
211KB

MD5
526e33de2a2d7f0e5c001880c377b7de

SHA1
9963ea2cd1aecf25b484abcc2c83ccbc586dac29

SHA256
6260c150b5a9a586388c00328f24162227c6f25f2a92e01f831c8048c59d9abe

SHA512
f93031040f0483479d7b9fbb322417235721eccfd053102cb4fa78d2dfc4e097f002028a6f8173b89380a5d7c515fa813c568013a2747cbc69a00f443cc562a6

Download Submit
memory/2180-33-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-36-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4116-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4116-38-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download