5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe
Size

211KB
MD5

92c9f66aca1907e044d7b7ad2d06d851
SHA1

5a656d6bae2042c00161d2f2380189cc7bad8c29
SHA256

5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff
SHA512

c02ccb4082e9b290989cdc39abdfc68be9592f2c1b6bb2dbe9598e150de09d6a32f0038c034e2f5d7dd9eae23aef069f9e1fd49162dab308caea6deec6027ad1
SSDEEP

3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOO:Jh8cBzHLRMpZ4d1ZO

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	swchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	userinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	swchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	userinit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4164	userinit.exe
3028	spoolsw.exe
3940	swchost.exe
4504	spoolsw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	swchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\system\udsys.exe	userinit.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\userinit.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	swchost.exe
File opened for modification	\??\c:\windows\userinit.exe	5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe
File opened for modification	\??\c:\windows\spoolsw.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	spoolsw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
720	5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe
720	5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe
4164	userinit.exe
4164	userinit.exe
4164	userinit.exe
4164	userinit.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe
4164	userinit.exe
4164	userinit.exe
3940	swchost.exe
3940	swchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4164	userinit.exe
3940	swchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
720	5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe
720	5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe
4164	userinit.exe
4164	userinit.exe
3028	spoolsw.exe
3028	spoolsw.exe
3940	swchost.exe
3940	swchost.exe
4504	spoolsw.exe
4504	spoolsw.exe
4164	userinit.exe
4164	userinit.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4164	720	5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe	85
PID 720 wrote to memory of 4164	720	5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe	85
PID 720 wrote to memory of 4164	720	5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe	85
PID 4164 wrote to memory of 3028	4164	userinit.exe	86
PID 4164 wrote to memory of 3028	4164	userinit.exe	86
PID 4164 wrote to memory of 3028	4164	userinit.exe	86
PID 3028 wrote to memory of 3940	3028	spoolsw.exe	87
PID 3028 wrote to memory of 3940	3028	spoolsw.exe	87
PID 3028 wrote to memory of 3940	3028	spoolsw.exe	87
PID 3940 wrote to memory of 4504	3940	swchost.exe	88
PID 3940 wrote to memory of 4504	3940	swchost.exe	88
PID 3940 wrote to memory of 4504	3940	swchost.exe	88

C:\Users\Admin\AppData\Local\Temp\5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe
"C:\Users\Admin\AppData\Local\Temp\5294ec64ae3bca89b85906e709bff86fd3a68b4e259fb83545bb323215fe08ff.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720
- \??\c:\windows\userinit.exe
  c:\windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4164
- - \??\c:\windows\spoolsw.exe
    c:\windows\spoolsw.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - \??\c:\windows\swchost.exe
      c:\windows\swchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3940
    - - \??\c:\windows\spoolsw.exe
        
        c:\windows\spoolsw.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mrsys.exe

Filesize
211KB

MD5
fa74fbf9c052a3d8f9e2ab25868eeae4

SHA1
95432f5a25edb436dfa1f46b654495613804b19d

SHA256
9d826bedacf6ed305707b739b4ede2bb905a49dab5d8dfe3ba2dc90418d4b29c

SHA512
a339e19c7d02a89cffcb0f24d0e59743aeacbb834ef19641e7c46d5e12c49742696177368e532ab72e2613a4813873c1ec962ce915ed9eb23c7872f6d1ea7b9a

Download Submit
C:\Windows\spoolsw.exe

Filesize
211KB

MD5
b18637078de456883783bba5a8e681a6

SHA1
90a0b3887fc2436f946773d08ee1b0399976845e

SHA256
d2b40d00166feea6214678ad0faafc8c159377fb3e75b67b8ebf9814933d1c03

SHA512
d9f86f32d2f7fe73ab590f6374dfe55f0322fc89a740e3b0e02fc9d128e14ee95628d0910ecbb49cc49edf2b227af0e82ba53ba1a638ab8d9e05bc8dbfa13dbe

Download Submit
C:\Windows\swchost.exe

Filesize
211KB

MD5
92a32f6023886f46cb32fc3f7168f67a

SHA1
ef758f14c558f347ce18deed2cdf224caa698616

SHA256
13a4640eb6e708222ef54ccfc04df5648924f198ee13bd56166ea2650ecdc696

SHA512
442c7dbdf325e99707669b6f4721159a827e5fe9776573f4e84eb1f87d1ecb568fdab99aaa3eb1bbd861bc31960c1c03deffa708c8acf8cf958bb71a1b15d5f1

Download Submit
C:\Windows\userinit.exe

Filesize
211KB

MD5
952ee6b49d4d1ec87041f6760115d78b

SHA1
3039baf3346994f29af3c895f18ed18ee1ac5ad9

SHA256
7d4c5f5f5f3df046d2a3308452386f927ed395133ab71b2bb2915c829f533603

SHA512
cacdfa10a2765bd184d7cd9317d437030092a2b1547c2f22aad57f2c7570231b3416dc958cb967ae878efb446b30483e7e3819dc85d8376d88a6c487f0901b45

Download Submit