Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 02:26
Behavioral task
behavioral1
Sample
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe
Resource
win10v2004-20240508-en
General
-
Target
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe
-
Size
69KB
-
MD5
bfc41158ac74fc66b1b45ed13ee045b8
-
SHA1
e3ac999666e4137f284b34589afb28658ed9ab4f
-
SHA256
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64
-
SHA512
b520cf7cbe230e963441d456a6854a46f5726d7cc2fdeeefadaf164cb377dcbbf273965ddb3a38c8eda257115f2558a2a5a601e42e7527e9e35fd40499b5cc0c
-
SSDEEP
1536:EJrFDMRyriCY/qXfatMp4Q2V6fIMxIpL3:0F8dCY85TE6fIMSR3
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
UPX dump on OEP (original entry point) 12 IoCs
Processes:
resource yara_rule behavioral2/memory/3580-0-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\Windows\System\explorer.exe UPX C:\Windows\System\spoolsv.exe UPX behavioral2/memory/372-17-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\Windows\System\svchost.exe UPX behavioral2/memory/4912-36-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/372-39-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/3580-40-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\mrsys.exe UPX behavioral2/memory/1300-42-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/3340-43-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/1300-52-0x0000000000400000-0x0000000000434000-memory.dmp UPX -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 1300 explorer.exe 372 spoolsv.exe 3340 svchost.exe 4912 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/3580-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\Windows\System\explorer.exe upx C:\Windows\System\spoolsv.exe upx behavioral2/memory/372-17-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\Windows\System\svchost.exe upx behavioral2/memory/4912-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/372-39-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3580-40-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mrsys.exe upx behavioral2/memory/1300-42-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3340-43-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1300-52-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
Processes:
explorer.exesvchost.exeb93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exeexplorer.exesvchost.exepid process 3580 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe 3580 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe 1300 explorer.exe 1300 explorer.exe 3340 svchost.exe 3340 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 1300 explorer.exe 3340 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 3580 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe 3580 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe 1300 explorer.exe 1300 explorer.exe 372 spoolsv.exe 372 spoolsv.exe 3340 svchost.exe 3340 svchost.exe 4912 spoolsv.exe 4912 spoolsv.exe 1300 explorer.exe 1300 explorer.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 3580 wrote to memory of 1300 3580 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe explorer.exe PID 3580 wrote to memory of 1300 3580 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe explorer.exe PID 3580 wrote to memory of 1300 3580 b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe explorer.exe PID 1300 wrote to memory of 372 1300 explorer.exe spoolsv.exe PID 1300 wrote to memory of 372 1300 explorer.exe spoolsv.exe PID 1300 wrote to memory of 372 1300 explorer.exe spoolsv.exe PID 372 wrote to memory of 3340 372 spoolsv.exe svchost.exe PID 372 wrote to memory of 3340 372 spoolsv.exe svchost.exe PID 372 wrote to memory of 3340 372 spoolsv.exe svchost.exe PID 3340 wrote to memory of 4912 3340 svchost.exe spoolsv.exe PID 3340 wrote to memory of 4912 3340 svchost.exe spoolsv.exe PID 3340 wrote to memory of 4912 3340 svchost.exe spoolsv.exe PID 3340 wrote to memory of 2884 3340 svchost.exe at.exe PID 3340 wrote to memory of 2884 3340 svchost.exe at.exe PID 3340 wrote to memory of 2884 3340 svchost.exe at.exe PID 3340 wrote to memory of 1172 3340 svchost.exe at.exe PID 3340 wrote to memory of 1172 3340 svchost.exe at.exe PID 3340 wrote to memory of 1172 3340 svchost.exe at.exe PID 3340 wrote to memory of 1712 3340 svchost.exe at.exe PID 3340 wrote to memory of 1712 3340 svchost.exe at.exe PID 3340 wrote to memory of 1712 3340 svchost.exe at.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe"C:\Users\Admin\AppData\Local\Temp\b93739acaed9d2f6a48c9ab2239165c8e4741ec4b6de6643ba1efca12bec7d64.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4912 -
C:\Windows\SysWOW64\at.exeat 02:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2884
-
C:\Windows\SysWOW64\at.exeat 02:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1172
-
C:\Windows\SysWOW64\at.exeat 02:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1712
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\mrsys.exeFilesize
69KB
MD561e2514bbf9e9158bd10d6c2152d499e
SHA11e7c14894f4114d48f14ed0ad7cc1e313a3f0714
SHA2564fd3c4794e77b37963b565866c436f017c83c4fff3d5065365dc0dceac4510ee
SHA51204c6ddea3c604f6b2eb547aed6dc54acdae2fd14e375fd6d3d063b974743f26891d10757aeef1bd0fe12abcbcb5eeb169907f958f12d2514edc26720ab88b32a
-
C:\Windows\System\explorer.exeFilesize
69KB
MD57b66f7b4e3550bb3b55c47da1a2d9ef6
SHA124905d88e2fc79296038b28eca69abc3bb6d8f91
SHA256b29b056a032a9fc51da902e3113c8db91d9c74640accd5fd3a32ad1e6b9874dc
SHA512b2d3e1b8aa73863645389c95bc64e7d3d97bf388315ab3fa137de2f3aa6b82703d14ad906bc5f3de856a5e8f20c4bd721b3c3cd07aab4df120c42963f353f91c
-
C:\Windows\System\spoolsv.exeFilesize
69KB
MD559d252d47b6115d0f46d442d63175140
SHA1c97f14f7f0e4b6df5a64fc6b44402c72081264c7
SHA25692d48cc434f2c27f51967b484fa51c14f1bfa818f021704e3ae96d3dc4a50d26
SHA512bb1d7e1fe647f10673886c026ba0718779da78a4a074701d9939afc7edc2953903b44ced1a67212a5a12b0a756b30b03dbc5818298cb3b0a5095ff90556cff07
-
C:\Windows\System\svchost.exeFilesize
69KB
MD5d3997b6700085eacd312f8aa256d36bb
SHA1c0bf256a32b26df0025d545b34f524f341b62bbc
SHA2568b153b34261907003fe2899e38090c1188b35250ecf19444dc7fe67e522cff7f
SHA51228a50338c760241e1f83ab72fcac3de204225d03dbeac2b7b5c9afd38055dc6390ebd532ae9914308ff1760768a7a756f64b7e2824f1da3dcafc008d8c351ff8
-
memory/372-17-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/372-39-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1300-42-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1300-52-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/3340-43-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/3580-0-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/3580-40-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4912-36-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB