dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe
Size

66KB
MD5

7af92f5c044483ff6391b30c319d67cf
SHA1

0a7f034acd5e866a66f48f5e0e714a8f49df8dcb
SHA256

dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa
SHA512

a2d6ae83bcb42fe0f037a0e89c48449766210227667b047cde66fbda78bced21a17b0ce3a83fe82d0b90a1eb18d920575deae40a7b4a335717be04ea6f6d03e4
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi7:IeklMMYJhqezw/pXzH9i7

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3016	explorer.exe
2612	spoolsv.exe
2280	svchost.exe
2396	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1652	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe
1652	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe
3016	explorer.exe
3016	explorer.exe
2612	spoolsv.exe
2612	spoolsv.exe
2280	svchost.exe
2280	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1652	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe
3016	explorer.exe
3016	explorer.exe
3016	explorer.exe
3016	explorer.exe
2280	svchost.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe
2280	svchost.exe
3016	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3016	explorer.exe
2280	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1652	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe
1652	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe
3016	explorer.exe
3016	explorer.exe
2612	spoolsv.exe
2612	spoolsv.exe
2280	svchost.exe
2280	svchost.exe
2396	spoolsv.exe
2396	spoolsv.exe
3016	explorer.exe
3016	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3016	1652	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe	28
PID 1652 wrote to memory of 3016	1652	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe	28
PID 1652 wrote to memory of 3016	1652	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe	28
PID 1652 wrote to memory of 3016	1652	dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe	28
PID 3016 wrote to memory of 2612	3016	explorer.exe	29
PID 3016 wrote to memory of 2612	3016	explorer.exe	29
PID 3016 wrote to memory of 2612	3016	explorer.exe	29
PID 3016 wrote to memory of 2612	3016	explorer.exe	29
PID 2612 wrote to memory of 2280	2612	spoolsv.exe	30
PID 2612 wrote to memory of 2280	2612	spoolsv.exe	30
PID 2612 wrote to memory of 2280	2612	spoolsv.exe	30
PID 2612 wrote to memory of 2280	2612	spoolsv.exe	30
PID 2280 wrote to memory of 2396	2280	svchost.exe	31
PID 2280 wrote to memory of 2396	2280	svchost.exe	31
PID 2280 wrote to memory of 2396	2280	svchost.exe	31
PID 2280 wrote to memory of 2396	2280	svchost.exe	31
PID 2280 wrote to memory of 2712	2280	svchost.exe	32
PID 2280 wrote to memory of 2712	2280	svchost.exe	32
PID 2280 wrote to memory of 2712	2280	svchost.exe	32
PID 2280 wrote to memory of 2712	2280	svchost.exe	32
PID 2280 wrote to memory of 836	2280	svchost.exe	36
PID 2280 wrote to memory of 836	2280	svchost.exe	36
PID 2280 wrote to memory of 836	2280	svchost.exe	36
PID 2280 wrote to memory of 836	2280	svchost.exe	36
PID 2280 wrote to memory of 3020	2280	svchost.exe	38
PID 2280 wrote to memory of 3020	2280	svchost.exe	38
PID 2280 wrote to memory of 3020	2280	svchost.exe	38
PID 2280 wrote to memory of 3020	2280	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe
"C:\Users\Admin\AppData\Local\Temp\dd4abed8aceb1a0d51995261cab8e68d0ac832c6872db6a098d0c38d7a1ff4fa.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3016
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2712
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:38 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:836
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
d229f617db1d3f689434d4df7181dd7c

SHA1
c6fa5b2e55414a721511255cf352db05cb3b003c

SHA256
f700a949e887bde25749b81eb46cc46063a2fca01bfb845bf4350fbf3f9c96e0

SHA512
361442ea8533341cac7eda15ef8ad611ccf4f39364963f211bb0fdf1f35ad708a871a280073e9c6b796e67f313ef5162d738b9a13d909ecefb444e45b13003ac

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
a57d58d0a646528ed98d7d5edddfec67

SHA1
592065f9e0070c942c900d44a78669e4cd280bda

SHA256
2ee1fbcd2d2266cab7050efeac7dcbc84c1e92765c69ec4152ff3ca7268bd650

SHA512
b90c2b0c786e15134f6e1f952eb458bfd5d8db1ca620840c217e251acc0234e5182f7bf11c703aedca2f77d03af30f825d2b035f582ebea5b8e5c05194d9b987

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
b40493f827a1045987dc790565e196d6

SHA1
272c550f8e6b839d98f9632456206c7f67c2731c

SHA256
86b95ab90c88c120ecbd7c388782b2706788380c7eebd82ae934339c4f6858e7

SHA512
b0a43a5e6044c9a8513a69ad912a0d28a4f659cbc3d96c8878af4f3cf7c575a4e6a516a00591ebf0dc14ffea61b53eee8725bc3f68e346716e1cbe8e43e6d855

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
34dfb4fc23c5eb5424cca92568198160

SHA1
46af543395dd0f6a8cd19390193e79cc76e4f40e

SHA256
7743fdeb189409ea55b41fe982be58a69e1d31615fae3385176cce024407ea33

SHA512
44b047b5b76b681f0abdbe9ae7af7430519dd607ecb5ccfe731183fb6264f0a90521d675b5fa07ae5c75712b79fbca69cb5e56bd1f42ed657bb18763ccbc9930

Download Submit
memory/1652-80-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1652-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1652-17-0x00000000026C0000-0x00000000026F1000-memory.dmp

Filesize
196KB

Download
memory/1652-66-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1652-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1652-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1652-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1652-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1652-64-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1652-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2280-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2280-53-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2280-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2280-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2396-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2396-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2612-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2612-56-0x0000000002C80000-0x0000000002CB1000-memory.dmp

Filesize
196KB

Download
memory/2612-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2612-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2612-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3016-35-0x0000000002700000-0x0000000002731000-memory.dmp

Filesize
196KB

Download
memory/3016-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3016-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3016-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3016-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3016-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download