f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103

General

Target

f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe
Size

66KB
MD5

87a2bb2b79956f8fd7ea71ae7d0782fe
SHA1

ae16645d2f25b83016dc8e32d2ae9dce4dcf6eac
SHA256

f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103
SHA512

2fcfe2af5e26430ddc390dddc90cc0da986e123538e5f194590a5caaa0e4985355ce55e42a495498b7e081d783f27e0d32a5ee3893132eac9ac2d0ba0e227b4e
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi5oKoKoKoKoKoKoKoKoKoKr:IeklMMYJhqezw/pXzH9ix

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

3020 explorer.exe
2792 spoolsv.exe
2772 svchost.exe
2464 spoolsv.exe

pid	process
3020	explorer.exe
2792	spoolsv.exe
2772	svchost.exe
2464	spoolsv.exe

Loads dropped DLL 8 IoCs

Processes:

f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exeexplorer.exespoolsv.exesvchost.exe

pid	process
2100	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe
2100	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe
3020	explorer.exe
3020	explorer.exe
2792	spoolsv.exe
2792	spoolsv.exe
2772	svchost.exe
2772	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

Processes:

f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exeexplorer.exespoolsv.exesvchost.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exeexplorer.exesvchost.exe

pid	process
2100	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe
3020	explorer.exe
3020	explorer.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
2772	svchost.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
3020	explorer.exe
2772	svchost.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
2772	svchost.exe
3020	explorer.exe
3020	explorer.exe
2772	svchost.exe
2772	svchost.exe
3020	explorer.exe
2772	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

3020 explorer.exe
2772 svchost.exe

pid	process
3020	explorer.exe
2772	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2100	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe
2100	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe
3020	explorer.exe
3020	explorer.exe
2792	spoolsv.exe
2792	spoolsv.exe
2772	svchost.exe
2772	svchost.exe
2464	spoolsv.exe
2464	spoolsv.exe
3020	explorer.exe
3020	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2100 wrote to memory of 3020	2100	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe	explorer.exe
PID 2100 wrote to memory of 3020	2100	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe	explorer.exe
PID 2100 wrote to memory of 3020	2100	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe	explorer.exe
PID 2100 wrote to memory of 3020	2100	f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe	explorer.exe
PID 3020 wrote to memory of 2792	3020	explorer.exe	spoolsv.exe
PID 3020 wrote to memory of 2792	3020	explorer.exe	spoolsv.exe
PID 3020 wrote to memory of 2792	3020	explorer.exe	spoolsv.exe
PID 3020 wrote to memory of 2792	3020	explorer.exe	spoolsv.exe
PID 2792 wrote to memory of 2772	2792	spoolsv.exe	svchost.exe
PID 2792 wrote to memory of 2772	2792	spoolsv.exe	svchost.exe
PID 2792 wrote to memory of 2772	2792	spoolsv.exe	svchost.exe
PID 2792 wrote to memory of 2772	2792	spoolsv.exe	svchost.exe
PID 2772 wrote to memory of 2464	2772	svchost.exe	spoolsv.exe
PID 2772 wrote to memory of 2464	2772	svchost.exe	spoolsv.exe
PID 2772 wrote to memory of 2464	2772	svchost.exe	spoolsv.exe
PID 2772 wrote to memory of 2464	2772	svchost.exe	spoolsv.exe
PID 2772 wrote to memory of 1184	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 1184	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 1184	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 1184	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 2744	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 2744	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 2744	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 2744	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 2388	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 2388	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 2388	2772	svchost.exe	at.exe
PID 2772 wrote to memory of 2388	2772	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe
"C:\Users\Admin\AppData\Local\Temp\f3578a382a156f3da91e5dd1c0fe5ac7fe40954dfc5fd95e3d222e4b8f130103.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe PR
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2464

C:\Windows\SysWOW64\at.exe
at 05:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:1184

C:\Windows\SysWOW64\at.exe
at 05:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:2744

C:\Windows\SysWOW64\at.exe
at 05:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:2388

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe
Filesize
66KB

MD5
1aa07587ce4b72cd96f0246bccb07e0f

SHA1
68aad10e4634f53c83299f1e04352ada57712a5b

SHA256
18c70928bbd2bbec8998dc7c0415bc59badc1e132e8b604f21e8898da3b1c243

SHA512
178ab7fa8ebb950d6bdbf3a16c9c2f0946ddb07112f3a228392593313927da385b34b12b226655ea8e635d56307687cf7c392e88134a9e968f74448235149cef

Download Submit
\??\PIPE\atsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\system\explorer.exe
Filesize
66KB

MD5
95caa65beb1c97af04ab394aedfbee32

SHA1
7ae3713ac8cfdffe1b93475663fbf12bf8254de3

SHA256
aa327da36ec7699cd6764e399e17556f955e4e84ded3ca5afbe223bb67cb60cc

SHA512
af8bf6758eec6d35e9fb366703d97ea6f895030d80e36e460aac370499dd196b4e42db538477b97c5d2f7e64b1ff0f382bb4fe1d3b5349ad3c8435f91519f131

Download Submit
\Windows\system\spoolsv.exe
Filesize
66KB

MD5
23b2af20bfea1291ab26047386ca9c60

SHA1
82c33f2cb0898a5bea25ba9391e5f38bea0a1594

SHA256
bead13afc161f056ace9081b3f46b5b02ba633f0a024d0599226fb105b4fd2a0

SHA512
b441c3cd3e1ead8a64ba7f6022661f740752a0b7fe8c161157cb7bf5a31226dd72c32756ec396c1a566767b797e8894a2f3077145fe867a2a3ba3665947d4f30

Download Submit
\Windows\system\svchost.exe
Filesize
66KB

MD5
bded341b7517673e850a4b7829a2019b

SHA1
051b32e07ae33917dcd913faff4764e251b47f2c

SHA256
8c20ef36792673fabb77181481d8f6819be1ea24ac76479efcb163eadeda474a

SHA512
b53c3788fa9a7e9bd0b7ded5200d7a1f464c4ff9e0bb2528a87ebc3b3513b183d2cdde9489637506b49bb528d9786e572591f3dc41ac4599eb5443e33eb82310

Download Submit
memory/2100-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2100-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2100-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2100-65-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2100-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2100-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2100-83-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2100-68-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2100-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2100-16-0x0000000002730000-0x0000000002761000-memory.dmp

Filesize
196KB

Download
memory/2464-70-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2464-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2464-69-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2772-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2772-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2772-67-0x0000000001F00000-0x0000000001F31000-memory.dmp

Filesize
196KB

Download
memory/2772-87-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2772-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2772-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2792-48-0x00000000031B0000-0x00000000031E1000-memory.dmp

Filesize
196KB

Download
memory/2792-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2792-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2792-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2792-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3020-34-0x00000000024A0000-0x00000000024D1000-memory.dmp

Filesize
196KB

Download
memory/3020-35-0x00000000024A0000-0x00000000024D1000-memory.dmp

Filesize
196KB

Download
memory/3020-85-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3020-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3020-96-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3020-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads