df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab

Analysis

max time kernel
146s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe
Size

66KB
MD5

9a605ca94d4c380c4e3065e3d7d9888c
SHA1

f799c08750e479f56f67b33f56b9a8d3c9199e84
SHA256

df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab
SHA512

e28863d8125a262ff6bc47caa6c4e7dd30d07b27236c4e67a1ef37a9f52050ab87b689740e51e7fcf9d42ab7dc7c075dd7076437bb7c6938f3e29f728cea1c2d
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiF:IeklMMYJhqezw/pXzH9iF

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2540	explorer.exe
2620	spoolsv.exe
2608	svchost.exe
2844	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2656	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe
2656	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe
2540	explorer.exe
2540	explorer.exe
2620	spoolsv.exe
2620	spoolsv.exe
2608	svchost.exe
2608	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2656	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe
2540	explorer.exe
2540	explorer.exe
2540	explorer.exe
2540	explorer.exe
2540	explorer.exe
2608	svchost.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe
2540	explorer.exe
2608	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2540	explorer.exe
2608	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2656	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe
2656	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe
2540	explorer.exe
2540	explorer.exe
2620	spoolsv.exe
2620	spoolsv.exe
2608	svchost.exe
2608	svchost.exe
2844	spoolsv.exe
2844	spoolsv.exe
2540	explorer.exe
2540	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2540	2656	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe	28
PID 2656 wrote to memory of 2540	2656	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe	28
PID 2656 wrote to memory of 2540	2656	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe	28
PID 2656 wrote to memory of 2540	2656	df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe	28
PID 2540 wrote to memory of 2620	2540	explorer.exe	29
PID 2540 wrote to memory of 2620	2540	explorer.exe	29
PID 2540 wrote to memory of 2620	2540	explorer.exe	29
PID 2540 wrote to memory of 2620	2540	explorer.exe	29
PID 2620 wrote to memory of 2608	2620	spoolsv.exe	30
PID 2620 wrote to memory of 2608	2620	spoolsv.exe	30
PID 2620 wrote to memory of 2608	2620	spoolsv.exe	30
PID 2620 wrote to memory of 2608	2620	spoolsv.exe	30
PID 2608 wrote to memory of 2844	2608	svchost.exe	31
PID 2608 wrote to memory of 2844	2608	svchost.exe	31
PID 2608 wrote to memory of 2844	2608	svchost.exe	31
PID 2608 wrote to memory of 2844	2608	svchost.exe	31
PID 2608 wrote to memory of 596	2608	svchost.exe	32
PID 2608 wrote to memory of 596	2608	svchost.exe	32
PID 2608 wrote to memory of 596	2608	svchost.exe	32
PID 2608 wrote to memory of 596	2608	svchost.exe	32
PID 2608 wrote to memory of 1620	2608	svchost.exe	36
PID 2608 wrote to memory of 1620	2608	svchost.exe	36
PID 2608 wrote to memory of 1620	2608	svchost.exe	36
PID 2608 wrote to memory of 1620	2608	svchost.exe	36
PID 2608 wrote to memory of 3016	2608	svchost.exe	38
PID 2608 wrote to memory of 3016	2608	svchost.exe	38
PID 2608 wrote to memory of 3016	2608	svchost.exe	38
PID 2608 wrote to memory of 3016	2608	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe
"C:\Users\Admin\AppData\Local\Temp\df20327ae5c846b3dfc1d99bb1d617cc02a32b78d193487c07a1a6ab6f4916ab.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:596
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1620
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
e917cc3473dd1272f961e61357f539cd

SHA1
40ca4a6e58d26487c91bbc2021661d3e9a8ed682

SHA256
41555d2271c39213af94ee7851014a06280282c5a35f67f218d79794ce67e70b

SHA512
7e88a6e4da2fcc9b31c625fd728a2cf4609634c67b5de03d97058215a2f4b967450b3b4f30b3127998553bfd21750f1de52594eab2330d2a94a6aac9f32fb6b5

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
7e3147cfe1587244af1b0f549ce9ad92

SHA1
e27457bc5f9f26b2c74e47dffad20cf992ea69c9

SHA256
35afc924851bd553a9ba07355289f56936e9f77f8d0b285d185ceaecf519f52a

SHA512
4b6b3f42034ef8bb4f341ee0107a8b72a7d249b3645b83a59e086fa94f676c8ce69f2eccdd8f1d13d025a242760b5b8730471e1535da504479895c127981d87d

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
1d7e7cc38d604c09bda02fb61020fc38

SHA1
91e052bc80b50b163a6ee8d4689a12bea30c5bca

SHA256
dbde9395283eeebe940ce3a34669c8640d98c00706ec258b3f7715c73f3f8b0f

SHA512
0b578e34b471342c5b9002bb35851fdf9b278cec19371bea761c716a3108087f01c3cbd9305714d76b13545443ba0de76cd5a6e530c046ef4ae0c400191cd4ec

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
29087d9d845e9bab3e3082a7372143b3

SHA1
3ba6763e177bb3c4381ece168f0f5d1218a28aae

SHA256
d4261422962b8aa92aaae905308a65c5f04c9c06991583dfb42916f064637f54

SHA512
40833443926bc04ef4f4fd4a390329a40dcdacd5c429104847a4eae65220b191917c2063dc26f50eea1c1ee20b06d2ea9d437e0d1f2c6a68c73c71d1ce9f227e

Download Submit
memory/2540-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2540-35-0x0000000002620000-0x0000000002651000-memory.dmp

Filesize
196KB

Download
memory/2540-90-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2608-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2608-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2608-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2620-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2620-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2656-42-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2656-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2656-37-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2656-16-0x0000000002520000-0x0000000002551000-memory.dmp

Filesize
196KB

Download
memory/2656-17-0x0000000002520000-0x0000000002551000-memory.dmp

Filesize
196KB

Download
memory/2656-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2656-78-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2656-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2656-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2656-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2656-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2844-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2844-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download