510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
Size

65KB
MD5

159855cc07b8aa0060fc246a433a7576
SHA1

84c3950161c32cc5cd817a45f71d473ee9e2ed92
SHA256

510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9
SHA512

6a79e4a6523a3c637470067de683acee19fc9c26c3712464124796f2ce4bac362c726c1a4d714261557f8f4235e3eacc29b70f0e1c49f1fe8f1852291e171372
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuP999999999999999999Q:7WNqkOJWmo1HpM0MkTUmuQ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2184	explorer.exe
4848	spoolsv.exe
1308	svchost.exe
1164	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2676	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
2676	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe
2184	explorer.exe
2184	explorer.exe
1308	svchost.exe
1308	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2184	explorer.exe
1308	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2676	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
2676	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
2184	explorer.exe
2184	explorer.exe
4848	spoolsv.exe
4848	spoolsv.exe
1308	svchost.exe
1308	svchost.exe
1164	spoolsv.exe
1164	spoolsv.exe
2184	explorer.exe
2184	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2184	2676	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe	81
PID 2676 wrote to memory of 2184	2676	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe	81
PID 2676 wrote to memory of 2184	2676	510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe	81
PID 2184 wrote to memory of 4848	2184	explorer.exe	83
PID 2184 wrote to memory of 4848	2184	explorer.exe	83
PID 2184 wrote to memory of 4848	2184	explorer.exe	83
PID 4848 wrote to memory of 1308	4848	spoolsv.exe	84
PID 4848 wrote to memory of 1308	4848	spoolsv.exe	84
PID 4848 wrote to memory of 1308	4848	spoolsv.exe	84
PID 1308 wrote to memory of 1164	1308	svchost.exe	85
PID 1308 wrote to memory of 1164	1308	svchost.exe	85
PID 1308 wrote to memory of 1164	1308	svchost.exe	85
PID 1308 wrote to memory of 4916	1308	svchost.exe	87
PID 1308 wrote to memory of 4916	1308	svchost.exe	87
PID 1308 wrote to memory of 4916	1308	svchost.exe	87
PID 1308 wrote to memory of 2696	1308	svchost.exe	98
PID 1308 wrote to memory of 2696	1308	svchost.exe	98
PID 1308 wrote to memory of 2696	1308	svchost.exe	98
PID 1308 wrote to memory of 1184	1308	svchost.exe	100
PID 1308 wrote to memory of 1184	1308	svchost.exe	100
PID 1308 wrote to memory of 1184	1308	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe
"C:\Users\Admin\AppData\Local\Temp\510b1188eb4cd6c448bd6d0d5d112611f13203d2d7ddb47ca8c3d42ecae7f9e9.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2184
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4916
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2696
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
ffc9ea02560cc26f811caf595262dd89

SHA1
75bd3e0b0e1daa8d224046894ec79a78308f1698

SHA256
887e5508fc609b384ccaa589bb0d53c6e8703ae938991cfac801711cfdc20302

SHA512
177c1591a7dd330e616c00cb99f1d23b0b92bb6f90cb25d1bbdf8c1036ae91f6af7d33bb64bc7dfc5bba715b10809c05948bec8d5c1c03871e023e372ded1cb1

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
65KB

MD5
b21d0d18c382a4d14151505477dd19f5

SHA1
38766f6b36ead9fe0331e227598c0dbb9614cf77

SHA256
be04fb9d6d0ecdf744c7d3a0fafdde630416ff357d50d3991ce1623128ebe6a8

SHA512
b796cf05cdccc0b219ad9f2e5b7613db7bf5f6144318213015ae03fb9a93f44eed6f0a86fcbe3b113f41f637c7ed7a49ff153bb6d85fb87e44aa2b4162df589e

Download Submit
C:\Windows\System\svchost.exe

Filesize
65KB

MD5
db3dcdd32efdbafd344c0a4c786d557d

SHA1
9ad9b3a7bf768dc3723fd54ca44ee6242f5fce91

SHA256
ff67922008c4d5b23c191d381f2980573516edb8f9e70462effdaa513ada4baa

SHA512
0b71d489df0e711e31e512c3d932e5fc96c3768786107d9814776ea509eceb63b105aa82155b8309f31e9216e2664e4b888e39cfad7436995b297414a1027762

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
65KB

MD5
b3e85385795dd307ffa9e4f4cc41aa0b

SHA1
1f92fee5b906e28a88681ff5bed32a398abdd36d

SHA256
3dbd3652de4f7d6a6907ab9fc55b77cd0fdfe3b0cb64cdd627a9bf44514e4bd0

SHA512
0bfd6ccb3c7068283fc07768886d3283ea6cd76b7f2f1c973f70b312348a7e2187ce0224a0dc0d0eef8c0158cc2de9611fd36fe58126862a0db33cf53c035bde

Download Submit
memory/1164-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1164-44-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download
memory/1164-50-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1308-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1308-37-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download
memory/2184-17-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2184-14-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download
memory/2184-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2184-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2184-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-54-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/2676-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-56-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2676-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-2-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download
memory/2676-5-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2676-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/4848-29-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4848-31-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4848-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4848-25-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download