510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
Size

65KB
MD5

159855cc07b8aa0060fc246a433a7576
SHA1

84c3950161c32cc5cd817a45f71d473ee9e2ed92
SHA256

510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9
SHA512

6a79e4a6523a3c637470067de683acee19fc9c26c3712464124796f2ce4bac362c726c1a4d714261557f8f4235e3eacc29b70f0e1c49f1fe8f1852291e171372
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuP999999999999999999Q:7WNqkOJWmo1HpM0MkTUmuQ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2332	explorer.exe
2748	spoolsv.exe
2720	svchost.exe
2676	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
3056	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
3056	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
2332	explorer.exe
2332	explorer.exe
2748	spoolsv.exe
2748	spoolsv.exe
2720	svchost.exe
2720	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3056	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
2332	explorer.exe
2332	explorer.exe
2332	explorer.exe
2332	explorer.exe
2720	svchost.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe
2720	svchost.exe
2332	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2332	explorer.exe
2720	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3056	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
3056	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
2332	explorer.exe
2332	explorer.exe
2748	spoolsv.exe
2748	spoolsv.exe
2720	svchost.exe
2720	svchost.exe
2676	spoolsv.exe
2676	spoolsv.exe
2332	explorer.exe
2332	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2332	3056	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe	28
PID 3056 wrote to memory of 2332	3056	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe	28
PID 3056 wrote to memory of 2332	3056	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe	28
PID 3056 wrote to memory of 2332	3056	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe	28
PID 2332 wrote to memory of 2748	2332	explorer.exe	29
PID 2332 wrote to memory of 2748	2332	explorer.exe	29
PID 2332 wrote to memory of 2748	2332	explorer.exe	29
PID 2332 wrote to memory of 2748	2332	explorer.exe	29
PID 2748 wrote to memory of 2720	2748	spoolsv.exe	30
PID 2748 wrote to memory of 2720	2748	spoolsv.exe	30
PID 2748 wrote to memory of 2720	2748	spoolsv.exe	30
PID 2748 wrote to memory of 2720	2748	spoolsv.exe	30
PID 2720 wrote to memory of 2676	2720	svchost.exe	31
PID 2720 wrote to memory of 2676	2720	svchost.exe	31
PID 2720 wrote to memory of 2676	2720	svchost.exe	31
PID 2720 wrote to memory of 2676	2720	svchost.exe	31
PID 2720 wrote to memory of 2444	2720	svchost.exe	32
PID 2720 wrote to memory of 2444	2720	svchost.exe	32
PID 2720 wrote to memory of 2444	2720	svchost.exe	32
PID 2720 wrote to memory of 2444	2720	svchost.exe	32
PID 2720 wrote to memory of 756	2720	svchost.exe	36
PID 2720 wrote to memory of 756	2720	svchost.exe	36
PID 2720 wrote to memory of 756	2720	svchost.exe	36
PID 2720 wrote to memory of 756	2720	svchost.exe	36
PID 2720 wrote to memory of 1792	2720	svchost.exe	38
PID 2720 wrote to memory of 1792	2720	svchost.exe	38
PID 2720 wrote to memory of 1792	2720	svchost.exe	38
PID 2720 wrote to memory of 1792	2720	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
"C:\Users\Admin\AppData\Local\Temp\510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2332
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2444
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:756
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
2b78a610b2bddadec76424a2582b3ddb

SHA1
ae886fd6dc47137380d49bb7b7c00ee6e398e4ca

SHA256
319853ee2d410ec82a89e21e6d059efc00688ecaee81a824d1f32cfc1ef0614d

SHA512
b555488f4ebb2e6c34f67e73c2b289f5a419c42a3803cf7cad42fa6d937429125eaee573cab052ef73179edea7149257f7375c56e214416027675ebd8c2eb8e5

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
2ea1359d96209390dda3709c1833b7d9

SHA1
ea4297852071e5d22fd5feb47c59d91cb933e344

SHA256
7815f42bd70416bac71c228165f9a23462565708654b78bb6d0f44376e3505bd

SHA512
005c29a67b8db1dc8a4aa252b231fddcb2f14af2f9ea7a2f778a6f1d9882301a00a601b8a126727a9c546506321d037ffe27200b60ee225d7edf2dc53220d82e

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
20555322ca9d3e1a3cafa505e5ed39d8

SHA1
c9e20294c6d5f037bce1f82976120d889bca1acc

SHA256
c1ebc533c54c84b0d62c2bc0de768c0d34565330de3666ccb253c66ed56aff95

SHA512
4a4f587e5ba606c0a561c62104534c178ddce5d5ca291bb852b65cdd08548b7929ec3528a245111e28367310b4af2fff25ea507d81bb81489009fb736790d12b

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
b5bd811cbc3301ec39dd7632eb1d9f97

SHA1
2dd245499cb01badf3dc91728193e675af738caa

SHA256
85f7bde754631f62635e5cc04d803029664826e3691880b185030bcb8b78b9a7

SHA512
f22b228c171a9fdef9eddddcff28af250c131706775f4a99400c83600ee16f0cab693dad79976b5eefa7e6e66506c3960c54008c355e1d598ee940c58c745c19

Download Submit
memory/2332-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2332-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2332-67-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2332-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2332-35-0x0000000000540000-0x0000000000571000-memory.dmp

Filesize
196KB

Download
memory/2332-36-0x0000000000540000-0x0000000000571000-memory.dmp

Filesize
196KB

Download
memory/2332-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2332-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2720-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2720-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2720-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2720-64-0x00000000024E0000-0x0000000002511000-memory.dmp

Filesize
196KB

Download
memory/2748-39-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2748-38-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2748-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2748-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3056-18-0x0000000001DD0000-0x0000000001E01000-memory.dmp

Filesize
196KB

Download
memory/3056-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3056-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/3056-63-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3056-81-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3056-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3056-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3056-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3056-17-0x0000000001DD0000-0x0000000001E01000-memory.dmp

Filesize
196KB

Download
memory/3056-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download