aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe
Size

66KB
MD5

9556cd0936956a7c89dd986f2a67cba2
SHA1

a56fdfa018015497791bd666508b2c897ca384d6
SHA256

aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54
SHA512

d28ef7f05190417c4b9c85d9e107c9ddca7a8559ebcfca88d1a26c23a97f813facf8245517ad4a24e5f1688c13c09237d16e4d2f2c65596ea33938e552d35211
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXip55555555555555555555b:IeklMMYJhqezw/pXzH9iR

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
1784	explorer.exe
2916	spoolsv.exe
2772	svchost.exe
1768	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1928	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe
1928	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe
1784	explorer.exe
1784	explorer.exe
2916	spoolsv.exe
2916	spoolsv.exe
2772	svchost.exe
2772	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1928	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe
1784	explorer.exe
1784	explorer.exe
1784	explorer.exe
1784	explorer.exe
1784	explorer.exe
2772	svchost.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
1784	explorer.exe
2772	svchost.exe
2772	svchost.exe
1784	explorer.exe
1784	explorer.exe
2772	svchost.exe
2772	svchost.exe
1784	explorer.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
2772	svchost.exe
1784	explorer.exe
1784	explorer.exe
2772	svchost.exe
2772	svchost.exe
1784	explorer.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
1784	explorer.exe
2772	svchost.exe
2772	svchost.exe
1784	explorer.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
2772	svchost.exe
1784	explorer.exe
2772	svchost.exe
1784	explorer.exe
1784	explorer.exe
2772	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1784	explorer.exe
2772	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1928	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe
1928	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe
1784	explorer.exe
1784	explorer.exe
2916	spoolsv.exe
2916	spoolsv.exe
2772	svchost.exe
2772	svchost.exe
1768	spoolsv.exe
1768	spoolsv.exe
1784	explorer.exe
1784	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1784	1928	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe	28
PID 1928 wrote to memory of 1784	1928	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe	28
PID 1928 wrote to memory of 1784	1928	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe	28
PID 1928 wrote to memory of 1784	1928	aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe	28
PID 1784 wrote to memory of 2916	1784	explorer.exe	29
PID 1784 wrote to memory of 2916	1784	explorer.exe	29
PID 1784 wrote to memory of 2916	1784	explorer.exe	29
PID 1784 wrote to memory of 2916	1784	explorer.exe	29
PID 2916 wrote to memory of 2772	2916	spoolsv.exe	30
PID 2916 wrote to memory of 2772	2916	spoolsv.exe	30
PID 2916 wrote to memory of 2772	2916	spoolsv.exe	30
PID 2916 wrote to memory of 2772	2916	spoolsv.exe	30
PID 2772 wrote to memory of 1768	2772	svchost.exe	31
PID 2772 wrote to memory of 1768	2772	svchost.exe	31
PID 2772 wrote to memory of 1768	2772	svchost.exe	31
PID 2772 wrote to memory of 1768	2772	svchost.exe	31
PID 2772 wrote to memory of 2416	2772	svchost.exe	32
PID 2772 wrote to memory of 2416	2772	svchost.exe	32
PID 2772 wrote to memory of 2416	2772	svchost.exe	32
PID 2772 wrote to memory of 2416	2772	svchost.exe	32
PID 2772 wrote to memory of 2676	2772	svchost.exe	36
PID 2772 wrote to memory of 2676	2772	svchost.exe	36
PID 2772 wrote to memory of 2676	2772	svchost.exe	36
PID 2772 wrote to memory of 2676	2772	svchost.exe	36
PID 2772 wrote to memory of 2928	2772	svchost.exe	38
PID 2772 wrote to memory of 2928	2772	svchost.exe	38
PID 2772 wrote to memory of 2928	2772	svchost.exe	38
PID 2772 wrote to memory of 2928	2772	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe
"C:\Users\Admin\AppData\Local\Temp\aa86ac9b16f68b14add9690ac2fe63426bdc3649dfbbd3be0b43c22be246ad54.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1784
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2416
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2676
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
eea480b79933f4b05088600612861cba

SHA1
218db5cc75c23b6497ca69fcf479171f551c3402

SHA256
123d7d44f9e4f00fe37a5a3d56878935f86d0ba41ea377169d611346d88bbd05

SHA512
5d90132562b437a9bfe21d03a8c31cec6758f1786937acd63b3d72c839044c1d84c43760905ce453bfb92ad41d5fc69690d06b1e9f809c6eafc531f7b38c5eb2

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
a3cc8ef3ce99047112886bf2d17fb610

SHA1
ef2df5783f6a25241378091b6693a004018257dd

SHA256
50d3c1ecab63367278e1e6f32e393b3150ffd0b90991ba61a3757f20fd75db34

SHA512
606c5b6ec542dab35cfbf566dcb6c915292522109bb5eb0210b5987d96dba9773d3b703583add2d42b7331c7272fdf8ce1d807b28df5a47fd2939303c27399ae

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
64ac067ff5e958b5b03709a929f21878

SHA1
4479a36bc002a4c2dce5f1b981c402cf2360f42f

SHA256
8442b06098ddc278ef972107e7f9587ee3ce1d97cdbeef8bf2fa07fd7f28a3e4

SHA512
ee339e28eef5567d6fd6dc34b3c7706c001be15bf299bd8c17ecbd7cce827faf3dff06f395cc2346b1d686b697dbd2e497725938383994b8c07ca8c84d947a84

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
0feb201d53b73ab2733a3ac32656bda8

SHA1
01be4ab7d29f73034feefdfd7a71d28c020bd062

SHA256
3f293c4097eb9b5eb419b855d7ad39bc5016473b42a59012aae6b02563bdd506

SHA512
5446cf7b5456840f17db226d23ca3265a2ee27777d6b7d12acf0af1b7c27f92ef3c4eab15bce7c3abfecf8e9bb713fb32aa9e1fea18d54680bc88fe250843952

Download Submit
memory/1768-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1768-69-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1784-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1784-94-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1784-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1784-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1784-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1784-34-0x00000000027C0000-0x00000000027F1000-memory.dmp

Filesize
196KB

Download
memory/1928-47-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1928-11-0x00000000025E0000-0x0000000002611000-memory.dmp

Filesize
196KB

Download
memory/1928-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1928-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1928-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1928-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1928-53-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1928-18-0x00000000025E0000-0x0000000002611000-memory.dmp

Filesize
196KB

Download
memory/1928-82-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1928-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1928-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2772-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2772-66-0x0000000002560000-0x0000000002591000-memory.dmp

Filesize
196KB

Download
memory/2772-67-0x0000000002560000-0x0000000002591000-memory.dmp

Filesize
196KB

Download
memory/2772-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2772-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2772-85-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2916-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2916-54-0x0000000001F80000-0x0000000001FB1000-memory.dmp

Filesize
196KB

Download
memory/2916-40-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2916-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download