Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 02:26
Behavioral task
behavioral1
Sample
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe
Resource
win10v2004-20240508-en
General
-
Target
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe
-
Size
69KB
-
MD5
bfc41158ac74fc66b1b45ed13ee045b8
-
SHA1
e3ac999666e4137f284b34589afb28658ed9ab4f
-
SHA256
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64
-
SHA512
b520cf7cbe230e963441d456a6854a46f5726d7cc2fdeeefadaf164cb377dcbbf273965ddb3a38c8eda257115f2558a2a5a601e42e7527e9e35fd40499b5cc0c
-
SSDEEP
1536:EJrFDMRyriCY/qXfatMp4Q2V6fIMxIpL3:0F8dCY85TE6fIMSR3
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
UPX dump on OEP (original entry point) 14 IoCs
Processes:
resource yara_rule behavioral1/memory/1640-0-0x0000000000400000-0x0000000000434000-memory.dmp UPX \Windows\system\explorer.exe UPX behavioral1/memory/2060-15-0x0000000000400000-0x0000000000434000-memory.dmp UPX \Windows\system\spoolsv.exe UPX behavioral1/memory/2060-29-0x0000000002720000-0x0000000002754000-memory.dmp UPX \Windows\system\svchost.exe UPX behavioral1/memory/2868-53-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2868-57-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2716-61-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1640-63-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\mrsys.exe UPX behavioral1/memory/2772-66-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2060-65-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2060-75-0x0000000000400000-0x0000000000434000-memory.dmp UPX -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 2060 explorer.exe 2716 spoolsv.exe 2772 svchost.exe 2868 spoolsv.exe -
Loads dropped DLL 8 IoCs
Processes:
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exeexplorer.exespoolsv.exesvchost.exepid process 1640 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe 1640 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe 2060 explorer.exe 2060 explorer.exe 2716 spoolsv.exe 2716 spoolsv.exe 2772 svchost.exe 2772 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/1640-0-0x0000000000400000-0x0000000000434000-memory.dmp upx \Windows\system\explorer.exe upx behavioral1/memory/2060-15-0x0000000000400000-0x0000000000434000-memory.dmp upx \Windows\system\spoolsv.exe upx behavioral1/memory/2060-29-0x0000000002720000-0x0000000002754000-memory.dmp upx \Windows\system\svchost.exe upx behavioral1/memory/2868-53-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2868-57-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2716-61-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1640-63-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mrsys.exe upx behavioral1/memory/2772-66-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2060-65-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2060-75-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
Processes:
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exeexplorer.exespoolsv.exesvchost.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exeexplorer.exesvchost.exepid process 1640 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe 2060 explorer.exe 2060 explorer.exe 2060 explorer.exe 2060 explorer.exe 2772 svchost.exe 2772 svchost.exe 2772 svchost.exe 2060 explorer.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2772 svchost.exe 2060 explorer.exe 2060 explorer.exe 2772 svchost.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2060 explorer.exe 2772 svchost.exe 2772 svchost.exe 2060 explorer.exe 2060 explorer.exe 2772 svchost.exe 2772 svchost.exe 2060 explorer.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2772 svchost.exe 2060 explorer.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2772 svchost.exe 2060 explorer.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2772 svchost.exe 2060 explorer.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2060 explorer.exe 2772 svchost.exe 2772 svchost.exe 2060 explorer.exe 2060 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 2060 explorer.exe 2772 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 1640 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe 1640 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe 2060 explorer.exe 2060 explorer.exe 2716 spoolsv.exe 2716 spoolsv.exe 2772 svchost.exe 2772 svchost.exe 2868 spoolsv.exe 2868 spoolsv.exe 2060 explorer.exe 2060 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 1640 wrote to memory of 2060 1640 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe explorer.exe PID 1640 wrote to memory of 2060 1640 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe explorer.exe PID 1640 wrote to memory of 2060 1640 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe explorer.exe PID 1640 wrote to memory of 2060 1640 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe explorer.exe PID 2060 wrote to memory of 2716 2060 explorer.exe spoolsv.exe PID 2060 wrote to memory of 2716 2060 explorer.exe spoolsv.exe PID 2060 wrote to memory of 2716 2060 explorer.exe spoolsv.exe PID 2060 wrote to memory of 2716 2060 explorer.exe spoolsv.exe PID 2716 wrote to memory of 2772 2716 spoolsv.exe svchost.exe PID 2716 wrote to memory of 2772 2716 spoolsv.exe svchost.exe PID 2716 wrote to memory of 2772 2716 spoolsv.exe svchost.exe PID 2716 wrote to memory of 2772 2716 spoolsv.exe svchost.exe PID 2772 wrote to memory of 2868 2772 svchost.exe spoolsv.exe PID 2772 wrote to memory of 2868 2772 svchost.exe spoolsv.exe PID 2772 wrote to memory of 2868 2772 svchost.exe spoolsv.exe PID 2772 wrote to memory of 2868 2772 svchost.exe spoolsv.exe PID 2772 wrote to memory of 2564 2772 svchost.exe at.exe PID 2772 wrote to memory of 2564 2772 svchost.exe at.exe PID 2772 wrote to memory of 2564 2772 svchost.exe at.exe PID 2772 wrote to memory of 2564 2772 svchost.exe at.exe PID 2772 wrote to memory of 1540 2772 svchost.exe at.exe PID 2772 wrote to memory of 1540 2772 svchost.exe at.exe PID 2772 wrote to memory of 1540 2772 svchost.exe at.exe PID 2772 wrote to memory of 1540 2772 svchost.exe at.exe PID 2772 wrote to memory of 1468 2772 svchost.exe at.exe PID 2772 wrote to memory of 1468 2772 svchost.exe at.exe PID 2772 wrote to memory of 1468 2772 svchost.exe at.exe PID 2772 wrote to memory of 1468 2772 svchost.exe at.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe"C:\Users\Admin\AppData\Local\Temp\b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2868 -
C:\Windows\SysWOW64\at.exeat 02:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2564
-
C:\Windows\SysWOW64\at.exeat 02:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1540
-
C:\Windows\SysWOW64\at.exeat 02:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\mrsys.exeFilesize
69KB
MD53a247bc1c69e2e24f7fe2a024baa8f58
SHA10b6a2064a51fa8088391d6b68a853a7e68209904
SHA256c311c5ce00009c8dbcc8b92c5201b7cac4f995addcaae6b90bb12d7f32b8530d
SHA512aea8dc20972b688c6142598148613202f7dd074e66f50fb9336325ec33964cd65809ced2c50fe34569e3fb81c57321a124281edb0ab1d44cff9449faa9773967
-
\Windows\system\explorer.exeFilesize
69KB
MD52904896d2fb692efeb95e8b9d4511546
SHA1f73e365e7b25700b11646447c76f516a25b3f720
SHA256273f6b04d2200067e10586afeb3617ad9fbf3fdd4e36e7e18c341cef6ddd0c4c
SHA512fe261fbd3dcb38ae3b94c5dc720b0a9c6aa4942058bf291ff84c964677ba01470773e89e02af00b8c56a8ad1640bcaaf2d534afe1fcf43d300d7ec554d82a56e
-
\Windows\system\spoolsv.exeFilesize
70KB
MD5e23659edcd7f0a7dbbf0e47bc9734515
SHA1402cc2cb2cea5e913522852c9e72b7bbdc9ec055
SHA2561d07cc559fd4b17d7fe53aa67a70bebb7a82b543b7240554dcd003e1343c7a42
SHA5128d68b2711dd4572a28a89f627037f08c6ce9be25b7aa60bb9856bb58d137d0e75d7e22b9cb27e0e03161cbdd2a4fe747d52130e3945610e3254862408564cc48
-
\Windows\system\svchost.exeFilesize
69KB
MD55fefb534d1b340c10fd62d087f9bfae6
SHA1d2621f25375a9e4d226f9f842e27948b221c7dbc
SHA256aa3ffb88526fa80db097f560698d4191ed03d111d9e2df69a93e000fe37f6728
SHA5121609ff359b1cae262dc2aaeaa5c64f812fc0db396528520aa0005206b5d71f142ea6f3ad40005436c4991c8a8f812f8cfedd25af05237663f64adff06b2e365a
-
memory/1640-12-0x00000000025E0000-0x0000000002614000-memory.dmpFilesize
208KB
-
memory/1640-13-0x00000000025E0000-0x0000000002614000-memory.dmpFilesize
208KB
-
memory/1640-0-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1640-63-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2060-15-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2060-30-0x0000000002720000-0x0000000002754000-memory.dmpFilesize
208KB
-
memory/2060-29-0x0000000002720000-0x0000000002754000-memory.dmpFilesize
208KB
-
memory/2060-65-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2060-75-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2716-44-0x0000000001EF0000-0x0000000001F24000-memory.dmpFilesize
208KB
-
memory/2716-61-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2772-66-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2868-53-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2868-57-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB