b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe
Size 65KB
Sample240601-cv4qqsfd43
SHA256 b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0
MD5 b75108864dab448a0ce8ab58e1a74e60
SHA1 6ad830b1151c6c69443997961b47290e93f791b0
SHA512 f204b15898f0ff3f77332a0a2005bb2abf292c199c4677fbb7551e506daa58e34b7863c132a231154ffdc141997fc902a747d84a72e703c4720e1ef3d3725d3f
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuR:7WNqkOJWmo1HpM0MkTUmuR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2680	explorer.exe
896	spoolsv.exe
116	svchost.exe
4216	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2808	b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe
2808	b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe
2680	explorer.exe
2680	explorer.exe
2680	explorer.exe
2680	explorer.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe
2680	explorer.exe
2680	explorer.exe
116	svchost.exe
116	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2680	explorer.exe
116	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2808	b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe
2808	b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe
2680	explorer.exe
2680	explorer.exe
896	spoolsv.exe
896	spoolsv.exe
116	svchost.exe
116	svchost.exe
4216	spoolsv.exe
4216	spoolsv.exe
2680	explorer.exe
2680	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2680	2808	b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe	82
PID 2808 wrote to memory of 2680	2808	b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe	82
PID 2808 wrote to memory of 2680	2808	b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe	82
PID 2680 wrote to memory of 896	2680	explorer.exe	83
PID 2680 wrote to memory of 896	2680	explorer.exe	83
PID 2680 wrote to memory of 896	2680	explorer.exe	83
PID 896 wrote to memory of 116	896	spoolsv.exe	84
PID 896 wrote to memory of 116	896	spoolsv.exe	84
PID 896 wrote to memory of 116	896	spoolsv.exe	84
PID 116 wrote to memory of 4216	116	svchost.exe	85
PID 116 wrote to memory of 4216	116	svchost.exe	85
PID 116 wrote to memory of 4216	116	svchost.exe	85
PID 116 wrote to memory of 1476	116	svchost.exe	86
PID 116 wrote to memory of 1476	116	svchost.exe	86
PID 116 wrote to memory of 1476	116	svchost.exe	86
PID 116 wrote to memory of 4324	116	svchost.exe	101
PID 116 wrote to memory of 4324	116	svchost.exe	101
PID 116 wrote to memory of 4324	116	svchost.exe	101
PID 116 wrote to memory of 3760	116	svchost.exe	115
PID 116 wrote to memory of 3760	116	svchost.exe	115
PID 116 wrote to memory of 3760	116	svchost.exe	115

C:\Users\Admin\AppData\Local\Temp\b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe
"C:\Users\Admin\AppData\Local\Temp\b9057c96074523ca7094fdb762e9f6e4b702ae995d8ee9d379e7fb46804b0ff0.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2680
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:896
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4216
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1476
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4324
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 722c8b74e59b334b4dbdf3c85ccdb47cb83a3d418d7c1b152aac06db53bc3b83
MD5 82b8d36e76d10f174680e90cce2d1a57
SHA1 47c4687017e1dffc399df6d55ef9a2ca5d426789
SHA512 67cbaba4690c3a3dc6894cc4793d015f6a3b043494c34449c9763d9e3c656aac288b3667eddb0884c663bc3394e88e13ff183abf02633986703580134db5ebc6
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouy:7WNqkOJWmo1HpM0MkTUmuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 bd71a7c4c68fc897356fd1a37d93abe3b572b1a277c6701d9d87e3c54aaa2073
MD5 7e55bfc9950250999777c70a4d0e61b8
SHA1 386650f8cca099de21adc7d297f55153a3eab690
SHA512 bcd4e7291a311ad71c1603bd35bc05e7003d1d631d9dbe887059610cdcb4fc78711494dc5c547027adc15e1b0508e87998be8f05bafab8cf101546f918d7d81e
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouf:7WNqkOJWmo1HpM0MkTUmuf
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 5906075ba1ed04c36afbb952a147960c67588a403f17a9401e75156fadabb0b0
MD5 c6c04bdfb65f936a1728dd66327c81de
SHA1 914c85caad05d89b08830719f1f53943a427ce1b
SHA512 b7689d51a7260ca0a07f24ba7366c4a3a2f3814c992f13c604cfa6e1a5172c159d32fdcd32a93f41b0148e0793de9bd116cd014ebf4f83fe26122f443e7c4897
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouw:7WNqkOJWmo1HpM0MkTUmuw
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 b907260e9d3cf220b2519ba8732ea633b02a52b128719a78c00651c8872df54c
MD5 5ceafc249081242bc55b32eb13ba3d8c
SHA1 8ae2eeb7bf6750f06b18d03f1b74f99046edd61d
SHA512 2b2c9cb2f51c1d45a326aba6f205f4ebc5db886379a0cbc79c4d94b1d67cb2dc5364fd827bc3fc331d51b3b23601f66ec4694386bd42ce79e0acd39efa52644c
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuN:7WNqkOJWmo1HpM0MkTUmuN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/116-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/116-36-0x00000000750B0000-0x000000007520D000-memory.dmp

Download

memory/896-29-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/896-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/896-25-0x00000000750B0000-0x000000007520D000-memory.dmp

Download

memory/2680-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2680-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2680-14-0x00000000750B0000-0x000000007520D000-memory.dmp

Download

memory/2680-69-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2680-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2808-56-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2808-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2808-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2808-2-0x00000000750B0000-0x000000007520D000-memory.dmp

Download

memory/2808-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2808-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2808-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/4216-49-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4216-43-0x00000000750B0000-0x000000007520D000-memory.dmp

Download