ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
Size

66KB
MD5

433b4c76d30881f0e385db40658960ac
SHA1

4e753c7e8a77ce6cd1057656bd4824e36229a11e
SHA256

ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646
SHA512

28ab2862756aad132d2e0acccdc94e2d274e789e40256406b0afbbf0c27afa9eae9faf47ccf7bb37df0264a1e0011b922b2e23adfadb532275880db79ec7e130
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiC:IeklMMYJhqezw/pXzH9iC

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4804	explorer.exe
880	spoolsv.exe
1576	svchost.exe
3356	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2644	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
2644	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe
4804	explorer.exe
1576	svchost.exe
1576	svchost.exe
1576	svchost.exe
4804	explorer.exe
4804	explorer.exe
1576	svchost.exe
1576	svchost.exe
1576	svchost.exe
4804	explorer.exe
4804	explorer.exe
1576	svchost.exe
1576	svchost.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe
4804	explorer.exe
1576	svchost.exe
1576	svchost.exe
4804	explorer.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe
1576	svchost.exe
1576	svchost.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
1576	svchost.exe
1576	svchost.exe
1576	svchost.exe
1576	svchost.exe
4804	explorer.exe
4804	explorer.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe
1576	svchost.exe
1576	svchost.exe
4804	explorer.exe
1576	svchost.exe
4804	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4804	explorer.exe
1576	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2644	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
2644	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
4804	explorer.exe
4804	explorer.exe
880	spoolsv.exe
880	spoolsv.exe
1576	svchost.exe
1576	svchost.exe
3356	spoolsv.exe
3356	spoolsv.exe
4804	explorer.exe
4804	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4804	2644	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe	84
PID 2644 wrote to memory of 4804	2644	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe	84
PID 2644 wrote to memory of 4804	2644	ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe	84
PID 4804 wrote to memory of 880	4804	explorer.exe	85
PID 4804 wrote to memory of 880	4804	explorer.exe	85
PID 4804 wrote to memory of 880	4804	explorer.exe	85
PID 880 wrote to memory of 1576	880	spoolsv.exe	86
PID 880 wrote to memory of 1576	880	spoolsv.exe	86
PID 880 wrote to memory of 1576	880	spoolsv.exe	86
PID 1576 wrote to memory of 3356	1576	svchost.exe	87
PID 1576 wrote to memory of 3356	1576	svchost.exe	87
PID 1576 wrote to memory of 3356	1576	svchost.exe	87
PID 1576 wrote to memory of 4940	1576	svchost.exe	88
PID 1576 wrote to memory of 4940	1576	svchost.exe	88
PID 1576 wrote to memory of 4940	1576	svchost.exe	88
PID 1576 wrote to memory of 1420	1576	svchost.exe	104
PID 1576 wrote to memory of 1420	1576	svchost.exe	104
PID 1576 wrote to memory of 1420	1576	svchost.exe	104
PID 1576 wrote to memory of 2664	1576	svchost.exe	113
PID 1576 wrote to memory of 2664	1576	svchost.exe	113
PID 1576 wrote to memory of 2664	1576	svchost.exe	113

C:\Users\Admin\AppData\Local\Temp\ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe
"C:\Users\Admin\AppData\Local\Temp\ae541510165fd301120ad74e30423ef504eee48fdb920cc7da76d1f26626a646.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4804
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:880
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3356
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1420
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
d183a6314fdeeb9d58c887234e35fa27

SHA1
70b6efc2788630fbd1440df0bbd8398e2b6cf5b5

SHA256
ea96b4731e95841164ae953de09971344f077f87f1a67178bb6b48b265c7273e

SHA512
c5ee4e198776a85328689b4c27ee4eb918275ad198acebc39ab091642f500cb9204b50be051657c16e9c8a56fe63de7d31b5a5165dde4651dc6f830d077fdc48

Download Submit
C:\Windows\System\explorer.exe

Filesize
66KB

MD5
21d128f6dc85b744554454872cc0b7d3

SHA1
06aafd83bdada5a1ae37b51058539e5ee15a84d5

SHA256
6b20c309c22418877886249295a3cd3bd793c11ede90a08c5f029dd7d71419d1

SHA512
7f1136e8255889cbe41a02bb349404a77d4848320e41aae5711c7042a1f7ab67d6030b430ad82c6a82f9d97d41d008114a507ea2fd3e6587d55caf16c9a9f70b

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
66KB

MD5
8daae923d056ec75019552b56f74c4f4

SHA1
122f6ad17290eb1643cc43409c4d6fd844c9d0af

SHA256
201725046effd983a00a48f8b3060e09c4c5aa8ddb2c59e21134f69624b5a9bf

SHA512
0fee0a80fd9d4133f4d5d1eee367571d6aa8d5efbc012e67919750d33df489c82de9eed06d57ddbee8999891ba3157ec46023f8f5021b537749a71b354f9c713

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
66KB

MD5
53f5e24123da53219ab4b1142a38134f

SHA1
c95596ad9af3b3536992c8b1007850d18783d469

SHA256
c9b27188d8cb584ab04eb38e65266eff29f6e2a7f493cc7094f67362af7c05d8

SHA512
f78162e7c4059430d2d83a99579aa65cd8bf479f2fad9df0a6ea21acb6e27457e00eafc79bcee3160c65c5578e33653485bc4741edb5e2e3ef38e999a35af994

Download Submit
memory/880-25-0x0000000075A80000-0x0000000075BDD000-memory.dmp

Filesize
1.4MB

Download
memory/880-53-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1576-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1576-36-0x0000000075A80000-0x0000000075BDD000-memory.dmp

Filesize
1.4MB

Download
memory/1576-35-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2644-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2644-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2644-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/2644-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2644-55-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2644-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2644-2-0x0000000075A80000-0x0000000075BDD000-memory.dmp

Filesize
1.4MB

Download
memory/3356-49-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3356-47-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3356-42-0x0000000075A80000-0x0000000075BDD000-memory.dmp

Filesize
1.4MB

Download
memory/4804-17-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4804-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4804-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4804-68-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4804-14-0x0000000075A80000-0x0000000075BDD000-memory.dmp

Filesize
1.4MB

Download