0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe
Size

66KB
MD5

a4b05dbb75c8eec38f583b931c430a20
SHA1

7d0636576d3dbb1a27bcd897d41e9e949a493552
SHA256

0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff
SHA512

765f0a10bf8aae54e2e18b777ccdf5727c3f69029289baa635c6526dab15c75c0cb2ee65a4dac062edf7d724e7ae7c6b558e70fa7aab5740083350627ba01fd3
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi7CCCCCCCCCCCCCCCCCCCC7:IeklMMYJhqezw/pXzH9iP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2204	explorer.exe
2544	spoolsv.exe
2448	svchost.exe
2152	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2812	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe
2812	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe
2204	explorer.exe
2204	explorer.exe
2544	spoolsv.exe
2544	spoolsv.exe
2448	svchost.exe
2448	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2812	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe
2204	explorer.exe
2204	explorer.exe
2204	explorer.exe
2204	explorer.exe
2448	svchost.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2204	explorer.exe
2448	svchost.exe
2448	svchost.exe
2204	explorer.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2448	svchost.exe
2204	explorer.exe
2204	explorer.exe
2448	svchost.exe
2448	svchost.exe
2204	explorer.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2204	explorer.exe
2448	svchost.exe
2448	svchost.exe
2204	explorer.exe
2204	explorer.exe
2448	svchost.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2204	explorer.exe
2448	svchost.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe
2448	svchost.exe
2204	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2204	explorer.exe
2448	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2812	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe
2812	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe
2204	explorer.exe
2204	explorer.exe
2544	spoolsv.exe
2544	spoolsv.exe
2448	svchost.exe
2448	svchost.exe
2152	spoolsv.exe
2152	spoolsv.exe
2204	explorer.exe
2204	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2204	2812	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe	28
PID 2812 wrote to memory of 2204	2812	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe	28
PID 2812 wrote to memory of 2204	2812	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe	28
PID 2812 wrote to memory of 2204	2812	0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe	28
PID 2204 wrote to memory of 2544	2204	explorer.exe	29
PID 2204 wrote to memory of 2544	2204	explorer.exe	29
PID 2204 wrote to memory of 2544	2204	explorer.exe	29
PID 2204 wrote to memory of 2544	2204	explorer.exe	29
PID 2544 wrote to memory of 2448	2544	spoolsv.exe	30
PID 2544 wrote to memory of 2448	2544	spoolsv.exe	30
PID 2544 wrote to memory of 2448	2544	spoolsv.exe	30
PID 2544 wrote to memory of 2448	2544	spoolsv.exe	30
PID 2448 wrote to memory of 2152	2448	svchost.exe	31
PID 2448 wrote to memory of 2152	2448	svchost.exe	31
PID 2448 wrote to memory of 2152	2448	svchost.exe	31
PID 2448 wrote to memory of 2152	2448	svchost.exe	31
PID 2448 wrote to memory of 2780	2448	svchost.exe	32
PID 2448 wrote to memory of 2780	2448	svchost.exe	32
PID 2448 wrote to memory of 2780	2448	svchost.exe	32
PID 2448 wrote to memory of 2780	2448	svchost.exe	32
PID 2448 wrote to memory of 1108	2448	svchost.exe	36
PID 2448 wrote to memory of 1108	2448	svchost.exe	36
PID 2448 wrote to memory of 1108	2448	svchost.exe	36
PID 2448 wrote to memory of 1108	2448	svchost.exe	36
PID 2448 wrote to memory of 2848	2448	svchost.exe	38
PID 2448 wrote to memory of 2848	2448	svchost.exe	38
PID 2448 wrote to memory of 2848	2448	svchost.exe	38
PID 2448 wrote to memory of 2848	2448	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe
"C:\Users\Admin\AppData\Local\Temp\0742b44b245affa4d76e5b90e8b647f72be79c8cbbc9b419f29509606bfa03ff.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2780
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1108
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:36 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
846d040b76491e65b1b11875301f4d4f

SHA1
91b679d03d5085d7d48dc0ef57c121be6c5bf756

SHA256
2d59abb397f87852884f31bd5d3a49ad76253ce710d3d3e3b9c1b0c94c97e74e

SHA512
cafb486fcd177e1319f35d0f87440c07a8534f9b8a934e3d779128ac9ee1c5909573d53c386840c71dd310efa848bbb591e00515e460bb220707f3e2870dfec8

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
9d00b99181b07d85d834868e341e0ae4

SHA1
62c1f0b23683c824a246c876a27134c2eea67ff2

SHA256
f41901bc6ffd7c034ed1a85d10b297c0635515f4ff74002189619590ca1ae8f6

SHA512
fac94d8a6c49ce86bda54bdd466babe8afb449cb63583caf322e75ac8b1b8a9e886962c400b4b1244ba053158ac6e3fecf1436f208986cf4815337ffa1c055a2

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
3145c58bf6c941afb1aaaf1d0d1f75ab

SHA1
81e4a574d5b06910c6e897f3d02751acb819028c

SHA256
3fa4e7cab664bbb3ddeb1ab9ae4b4bee7b85157bbc752d309f97ade75b3d7d81

SHA512
1124b0b379e56888aa69628b47dd910b02cf09cf5c714af26980f9e4ca38ebed8624131b0e30daaf76e0e64ae9e10d5dcabcda66cd2956bf62961069e8d5770c

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
fe9c0e879b86d1d45421c060d6ead1b7

SHA1
d04cd23c71c17306f92bbb6fb0485613f155595d

SHA256
8cc999061adef889bb4b2717d3389ddf99eb1bd65d0bfa23bcdcfebd2c42804c

SHA512
5911faca8dbd8f8eeb7a6486af813ac810df3e83c26131d9ba999552c5fb42a23228e459d143f9e57ad017099745cb7b19ea48065e1fa67cd3332c7b4e251190

Download Submit
memory/2152-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2152-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2204-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2204-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2204-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2204-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2204-21-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2204-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2204-37-0x0000000002C30000-0x0000000002C61000-memory.dmp

Filesize
196KB

Download
memory/2204-67-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2448-65-0x0000000002B80000-0x0000000002BB1000-memory.dmp

Filesize
196KB

Download
memory/2448-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2544-39-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2544-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2544-38-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2544-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2812-59-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2812-16-0x00000000026A0000-0x00000000026D1000-memory.dmp

Filesize
196KB

Download
memory/2812-17-0x00000000026A0000-0x00000000026D1000-memory.dmp

Filesize
196KB

Download
memory/2812-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2812-81-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2812-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2812-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2812-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2812-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2812-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download