ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
Size

66KB
MD5

433b4c76d30881f0e385db40658960ac
SHA1

4e753c7e8a77ce6cd1057656bd4824e36229a11e
SHA256

ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646
SHA512

28ab2862756aad132d2e0acccdc94e2d274e789e40256406b0afbbf0c27afa9eae9faf47ccf7bb37df0264a1e0011b922b2e23adfadb532275880db79ec7e130
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiC:IeklMMYJhqezw/pXzH9iC

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2476	explorer.exe
2716	spoolsv.exe
2684	svchost.exe
2404	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2036	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
2036	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
2476	explorer.exe
2476	explorer.exe
2716	spoolsv.exe
2716	spoolsv.exe
2684	svchost.exe
2684	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2036	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
2476	explorer.exe
2476	explorer.exe
2476	explorer.exe
2476	explorer.exe
2684	svchost.exe
2684	svchost.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2684	svchost.exe
2476	explorer.exe
2476	explorer.exe
2684	svchost.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2684	svchost.exe
2476	explorer.exe
2476	explorer.exe
2684	svchost.exe
2684	svchost.exe
2476	explorer.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2684	svchost.exe
2476	explorer.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2684	svchost.exe
2476	explorer.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe
2684	svchost.exe
2476	explorer.exe
2684	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2476	explorer.exe
2684	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2036	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
2036	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
2476	explorer.exe
2476	explorer.exe
2716	spoolsv.exe
2716	spoolsv.exe
2684	svchost.exe
2684	svchost.exe
2404	spoolsv.exe
2404	spoolsv.exe
2476	explorer.exe
2476	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2476	2036	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe	28
PID 2036 wrote to memory of 2476	2036	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe	28
PID 2036 wrote to memory of 2476	2036	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe	28
PID 2036 wrote to memory of 2476	2036	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe	28
PID 2476 wrote to memory of 2716	2476	explorer.exe	29
PID 2476 wrote to memory of 2716	2476	explorer.exe	29
PID 2476 wrote to memory of 2716	2476	explorer.exe	29
PID 2476 wrote to memory of 2716	2476	explorer.exe	29
PID 2716 wrote to memory of 2684	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2684	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2684	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2684	2716	spoolsv.exe	30
PID 2684 wrote to memory of 2404	2684	svchost.exe	31
PID 2684 wrote to memory of 2404	2684	svchost.exe	31
PID 2684 wrote to memory of 2404	2684	svchost.exe	31
PID 2684 wrote to memory of 2404	2684	svchost.exe	31
PID 2684 wrote to memory of 308	2684	svchost.exe	32
PID 2684 wrote to memory of 308	2684	svchost.exe	32
PID 2684 wrote to memory of 308	2684	svchost.exe	32
PID 2684 wrote to memory of 308	2684	svchost.exe	32
PID 2684 wrote to memory of 2944	2684	svchost.exe	36
PID 2684 wrote to memory of 2944	2684	svchost.exe	36
PID 2684 wrote to memory of 2944	2684	svchost.exe	36
PID 2684 wrote to memory of 2944	2684	svchost.exe	36
PID 2684 wrote to memory of 940	2684	svchost.exe	38
PID 2684 wrote to memory of 940	2684	svchost.exe	38
PID 2684 wrote to memory of 940	2684	svchost.exe	38
PID 2684 wrote to memory of 940	2684	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
"C:\Users\Admin\AppData\Local\Temp\ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2476
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:308
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2944
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
c0db762925d1e1dd9ce84c5252519ecd

SHA1
a9fde1062d35c67c89d33e6e38dd169c69fcca23

SHA256
24f0c6c6bcf1f33f7f9d789fbbee2ea412cc6276322a05278162e4b8aada4fbb

SHA512
a544de12fa508ca563ee8e72c782f27f146af4384d6bf384fe519adf5250b2ecb94e983c92d9f629afb8687029912e7019d0a1bd4c2d1c8356376e2688b923e9

Download Submit
C:\Windows\system\explorer.exe

Filesize
66KB

MD5
3523d852cd38bcfa6eab513dab29bc93

SHA1
cfe330b4bbddd5d42e998bf40fe043358694e308

SHA256
429019a3667d1e4e18ae78b15a75dd106e2383ebfcb3dfcdf7c26e3908af7f4d

SHA512
5cee1341f1cd9f2fb5d51e73f760093121f3e10d076150be1be852576bc6a6ea43946c0e50d998c687bb49fdd928ba47522b2a25b4fd415c339689edca9ed97d

Download Submit
C:\Windows\system\svchost.exe

Filesize
66KB

MD5
625ff4f6032b365c212d078415ce5db9

SHA1
1ef19a6d1db3e795fe2783caf30c075f999f6299

SHA256
0a77621e18155dfd2651ad02463f4f16934af94962b29319dd0f35f4176dc931

SHA512
f0f3ff1a15c4efb7324e984ba596802795f342ac0c348f17d665bda207d9d64b6a8cc19a3dd6eb423d0327a80712aa33766e5ebe005e91faff7f6f363095ba22

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
4765eadd921e0cb7a14bf8cc1d5e1465

SHA1
bf1695645b027f760a91252068c1951f4a690790

SHA256
a70552ec4815366c9488f745e3f5cd7f284c373a7b74d9416477adda8886b48d

SHA512
4d8b2f30a7e8f796924091a4957bc838f8dded4eee21e9b286b9d0485f6854c54f440c748b6734fbf2b01dd67f1507a324421ea44c25596bd5058bc1faf344a9

Download Submit
memory/2036-17-0x0000000002640000-0x0000000002671000-memory.dmp

Filesize
196KB

Download
memory/2036-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2036-80-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2036-18-0x0000000002640000-0x0000000002671000-memory.dmp

Filesize
196KB

Download
memory/2036-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2036-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2036-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2036-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2036-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2036-67-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2404-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2404-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2476-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2476-36-0x0000000002C40000-0x0000000002C71000-memory.dmp

Filesize
196KB

Download
memory/2476-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2476-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2476-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2476-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2684-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2684-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2684-65-0x00000000027A0000-0x00000000027D1000-memory.dmp

Filesize
196KB

Download
memory/2684-64-0x00000000027A0000-0x00000000027D1000-memory.dmp

Filesize
196KB

Download
memory/2684-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2716-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-46-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-54-0x0000000000580000-0x00000000005B1000-memory.dmp

Filesize
196KB

Download
memory/2716-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download