24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe
Size

206KB
MD5

3ad30b1b56f433615b64107644c2cedf
SHA1

3c9cc9693dd1eed23151cc923eafc27fef35c9fe
SHA256

24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840
SHA512

0f4b41c007055c69d0e11646b10d8f33ac0c3e623fa18c1cec3f4210ca15ab2b0fc4e62bb0ec394aae841baf20774115e56260e29086dd9b155daec86006eb1f
SSDEEP

3072:YvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unpxxxxxxxxxxxxxxxxxxxxxZ:YvEN2U+T6i5LirrllHy4HUcMQY6c

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2300	explorer.exe
2528	spoolsv.exe
2932	svchost.exe
2224	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1192	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe
1192	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe
2300	explorer.exe
2300	explorer.exe
2528	spoolsv.exe
2528	spoolsv.exe
2932	svchost.exe
2932	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1192	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2932	svchost.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe
2300	explorer.exe
2932	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2300	explorer.exe
2932	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1192	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe
1192	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe
2300	explorer.exe
2300	explorer.exe
2528	spoolsv.exe
2528	spoolsv.exe
2932	svchost.exe
2932	svchost.exe
2224	spoolsv.exe
2224	spoolsv.exe
2300	explorer.exe
2300	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2300	1192	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe	28
PID 1192 wrote to memory of 2300	1192	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe	28
PID 1192 wrote to memory of 2300	1192	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe	28
PID 1192 wrote to memory of 2300	1192	24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe	28
PID 2300 wrote to memory of 2528	2300	explorer.exe	29
PID 2300 wrote to memory of 2528	2300	explorer.exe	29
PID 2300 wrote to memory of 2528	2300	explorer.exe	29
PID 2300 wrote to memory of 2528	2300	explorer.exe	29
PID 2528 wrote to memory of 2932	2528	spoolsv.exe	30
PID 2528 wrote to memory of 2932	2528	spoolsv.exe	30
PID 2528 wrote to memory of 2932	2528	spoolsv.exe	30
PID 2528 wrote to memory of 2932	2528	spoolsv.exe	30
PID 2932 wrote to memory of 2224	2932	svchost.exe	31
PID 2932 wrote to memory of 2224	2932	svchost.exe	31
PID 2932 wrote to memory of 2224	2932	svchost.exe	31
PID 2932 wrote to memory of 2224	2932	svchost.exe	31
PID 2932 wrote to memory of 2500	2932	svchost.exe	32
PID 2932 wrote to memory of 2500	2932	svchost.exe	32
PID 2932 wrote to memory of 2500	2932	svchost.exe	32
PID 2932 wrote to memory of 2500	2932	svchost.exe	32
PID 2932 wrote to memory of 928	2932	svchost.exe	36
PID 2932 wrote to memory of 928	2932	svchost.exe	36
PID 2932 wrote to memory of 928	2932	svchost.exe	36
PID 2932 wrote to memory of 928	2932	svchost.exe	36
PID 2932 wrote to memory of 2520	2932	svchost.exe	38
PID 2932 wrote to memory of 2520	2932	svchost.exe	38
PID 2932 wrote to memory of 2520	2932	svchost.exe	38
PID 2932 wrote to memory of 2520	2932	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe
"C:\Users\Admin\AppData\Local\Temp\24965fe68a669f17d5a5e7aee73c302975c321174a415547a08d997b0e4d2840.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2300
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2500
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:928
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
2dafa2bec939078f6aabb7abbb0db0b9

SHA1
65c9ec604e689e0cf66e819897187268b706148f

SHA256
daf6fa189ef7e42c9b7610efa98188a1f959005fb5c8bcbb4fc6fea41828302a

SHA512
424d37a005673d51e7e6940a7d5efd5df6c9dbb9200070022efe42eb65f05d516901e069b07b82118a5c1fc089f2ee2b188c056308f126e9133481b298670824

Download Submit
\Windows\system\explorer.exe

Filesize
207KB

MD5
074175ef1b9705d1b1323a737fa0cae8

SHA1
78d48f44810dc7038177df71b9cbfb9b756d6a8d

SHA256
8e0ac40bdd6e3fa80737908ac2a0fb1dfb4205fa0357775afe8095c101aad627

SHA512
ba2786b9622c5eb3a9f7043171b95a7b5cd6e57c8ca4bb78b1ba03d4c8e640a147c1e2d3935cbcf545995b1d420a90145ad3789d0a4441a8a5955ae76c74ee3d

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
043e7b00f900da101c5cdbb8dec687f5

SHA1
461dc7db7f06c574e196059eeba11860bbb96a41

SHA256
ac0684aa5cca2e902b3416fb86d5d35d0f14cf0968bafc717b7846fb603046a8

SHA512
0b0fb2a16a4cb2f77643208b741a4610e7b3728088847a4f5767d5410e626fa131fddef544bbf2a7819f2cfcaae4072a5be4badf965648e9253408e27fb7c299

Download Submit
\Windows\system\svchost.exe

Filesize
206KB

MD5
1c08f0b2edda09f6da5d9ceb3f3c5f8c

SHA1
6fbabc16667c1576f8f1598d5eee8aa82fe3f833

SHA256
f7b0f7ab1fb65dd439e110f38fdc0253a0fa38e220880d89dd6d62415011f628

SHA512
203721321e516b42b5fdc6b806c859067357452d3951c8a7a60cbe6a80f32a4eeb21a68be98ec580c6113afaa53fb885e8bb1774f39aeb4aebb48df99ff47083

Download Submit
memory/1192-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1192-13-0x0000000002800000-0x000000000282F000-memory.dmp

Filesize
188KB

Download
memory/1192-58-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2224-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2528-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2528-42-0x00000000025A0000-0x00000000025CF000-memory.dmp

Filesize
188KB

Download
memory/2932-48-0x0000000001D30000-0x0000000001D5F000-memory.dmp

Filesize
188KB

Download
memory/2932-49-0x0000000001D30000-0x0000000001D5F000-memory.dmp

Filesize
188KB

Download
memory/2932-43-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download