59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe
Size

66KB
MD5

835a29ddcb263bf8e68d6ba1d541c7ab
SHA1

3f487df6d59df3e429c79cb65ca750fac39075d0
SHA256

59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220
SHA512

2f856edcafb95e34f7ddcd90734c02e08894faf01d23bf43947f703b5f5326d825c93ad1f24dfa1e25517fa3db951bb3b795ef754bd4062ab59f235d9b59558c
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiW:IeklMMYJhqezw/pXzH9iW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2800	explorer.exe
2680	spoolsv.exe
2628	svchost.exe
2660	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2864	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe
2864	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe
2800	explorer.exe
2800	explorer.exe
2680	spoolsv.exe
2680	spoolsv.exe
2628	svchost.exe
2628	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2864	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2628	svchost.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe
2800	explorer.exe
2628	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2800	explorer.exe
2628	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2864	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe
2864	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe
2800	explorer.exe
2800	explorer.exe
2680	spoolsv.exe
2680	spoolsv.exe
2628	svchost.exe
2628	svchost.exe
2660	spoolsv.exe
2660	spoolsv.exe
2800	explorer.exe
2800	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2800	2864	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe	28
PID 2864 wrote to memory of 2800	2864	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe	28
PID 2864 wrote to memory of 2800	2864	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe	28
PID 2864 wrote to memory of 2800	2864	59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe	28
PID 2800 wrote to memory of 2680	2800	explorer.exe	29
PID 2800 wrote to memory of 2680	2800	explorer.exe	29
PID 2800 wrote to memory of 2680	2800	explorer.exe	29
PID 2800 wrote to memory of 2680	2800	explorer.exe	29
PID 2680 wrote to memory of 2628	2680	spoolsv.exe	30
PID 2680 wrote to memory of 2628	2680	spoolsv.exe	30
PID 2680 wrote to memory of 2628	2680	spoolsv.exe	30
PID 2680 wrote to memory of 2628	2680	spoolsv.exe	30
PID 2628 wrote to memory of 2660	2628	svchost.exe	31
PID 2628 wrote to memory of 2660	2628	svchost.exe	31
PID 2628 wrote to memory of 2660	2628	svchost.exe	31
PID 2628 wrote to memory of 2660	2628	svchost.exe	31
PID 2628 wrote to memory of 2020	2628	svchost.exe	32
PID 2628 wrote to memory of 2020	2628	svchost.exe	32
PID 2628 wrote to memory of 2020	2628	svchost.exe	32
PID 2628 wrote to memory of 2020	2628	svchost.exe	32
PID 2628 wrote to memory of 1360	2628	svchost.exe	36
PID 2628 wrote to memory of 1360	2628	svchost.exe	36
PID 2628 wrote to memory of 1360	2628	svchost.exe	36
PID 2628 wrote to memory of 1360	2628	svchost.exe	36
PID 2628 wrote to memory of 1788	2628	svchost.exe	38
PID 2628 wrote to memory of 1788	2628	svchost.exe	38
PID 2628 wrote to memory of 1788	2628	svchost.exe	38
PID 2628 wrote to memory of 1788	2628	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe
"C:\Users\Admin\AppData\Local\Temp\59915f9410eca4a1e2b43888387ec215d6e5a7ccb39a58d2ebf4f5ebdf700220.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2800
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2020
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1360
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
f6fb94c927a9ee7faefef7a72937cce0

SHA1
d59679029079cef567b6ccb09eed669381f02b9d

SHA256
3ed41c108ce31b4a8e388fefa67aeca48538de1c5a044110f00af519f8c263f6

SHA512
4d9358a3a6253109ef904d496ee63c53ac44c2b3817b312b0e56c99dcfd29f1a2ab2bd6b533d20e340a94513724d13f81ca7ef3afcd774233fbe373bbba0e7d1

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
66KB

MD5
684d408f1cac56c8c6f6477b5a040ca5

SHA1
f1df4ea6eb0b3719b8629cbc92ffb14975aeef08

SHA256
34c6f1d4c3fed204c10635b80102a4cc739e014528bae4e463ae2bd295a3dc5d

SHA512
5bba3aa66b007555719f118b2be4824c78a0e1d2f2e7bd10e091b2a4fb3302afa6ff1e031af6dcd6b628b7c99bc4549bd218ef384a7ab86bf6799d5427d0de9e

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
e78572876b8aa7b54017d5da03717ef3

SHA1
f53c6fb1c933eb58ec8d4efa1fd9aca4903a2ba7

SHA256
45194dfc1988bb8c0a088fe0a72166e76c3dff090477c81330dd098908107da8

SHA512
46b1c3456270eb15b6585e38381e2e43b305363b75786aadad20f94bed61153e6b01716a8cedf56e0aa253c1ecdf8a3c45027dc903bc5930f044fdd24ad66c0a

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
4a219a4dcc1771ad530d3762e400c5da

SHA1
fca26d03cc7097657a8a2e2f4e6b05d2d0095ab9

SHA256
f3c01dfaba1ccf9b5d6282dc34452b3f2338d1d7ab66f473d10183e8ac923d18

SHA512
a0b8a063fa4ccd33a6134b9ea5374cc2bd3ec561602a12c28b6c653d798d91a12ef57e109b211a593bc0aa15cd58f2587070b5feb9fd7804657efb60edad5c64

Download Submit
memory/2628-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2628-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2628-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2660-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2660-65-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2680-53-0x0000000002CA0000-0x0000000002CD1000-memory.dmp

Filesize
196KB

Download
memory/2680-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2680-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2680-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2800-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2800-39-0x0000000002690000-0x00000000026C1000-memory.dmp

Filesize
196KB

Download
memory/2800-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2800-88-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2800-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2800-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2864-64-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2864-19-0x0000000000540000-0x0000000000571000-memory.dmp

Filesize
196KB

Download
memory/2864-12-0x0000000000540000-0x0000000000571000-memory.dmp

Filesize
196KB

Download
memory/2864-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2864-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2864-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2864-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2864-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2864-75-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2864-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download