Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 04:29
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe
- Size 1.4MB
- Sample240601-e4nrzsae64
- SHA256 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7
- MD5 0f3fd659178e94e64160607c50c2d912
- SHA1 8b19a37947db8ff301cc284a32fa6f52c589605a
- SHA512 ba56651417c53197626c539ad0cb94c8e36649c45cf6272c7a3e0a2736ee57efa3cef4f2a76a1c58bccd3f0caeb95b9a1c06afa1be347b7acf66a830df2603eb
- SSDEEP 24576:T9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMu:T9UX1uBx4mYo83vOSeyeaKrA
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Detects executables packed with Enigma 16 IoCs
resource yara_rule behavioral2/memory/1244-0-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/files/0x000900000002326e-9.dat INDICATOR_EXE_Packed_Enigma behavioral2/files/0x0008000000023274-15.dat INDICATOR_EXE_Packed_Enigma behavioral2/memory/4928-19-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/files/0x0008000000023278-26.dat INDICATOR_EXE_Packed_Enigma behavioral2/memory/1244-28-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/memory/2572-29-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/memory/224-34-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/memory/224-40-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/memory/4928-42-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/memory/1244-44-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/files/0x0009000000023276-45.dat INDICATOR_EXE_Packed_Enigma behavioral2/memory/2756-46-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/memory/2572-47-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/memory/2756-58-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma behavioral2/memory/2756-70-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Enigma - Detects packed executables observed in Molerats 16 IoCs
resource yara_rule behavioral2/memory/1244-0-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/files/0x000900000002326e-9.dat INDICATOR_EXE_Packed_Loader behavioral2/files/0x0008000000023274-15.dat INDICATOR_EXE_Packed_Loader behavioral2/memory/4928-19-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/files/0x0008000000023278-26.dat INDICATOR_EXE_Packed_Loader behavioral2/memory/1244-28-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/memory/2572-29-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/memory/224-34-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/memory/224-40-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/memory/4928-42-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/memory/1244-44-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/files/0x0009000000023276-45.dat INDICATOR_EXE_Packed_Loader behavioral2/memory/2756-46-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/memory/2572-47-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/memory/2756-58-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader behavioral2/memory/2756-70-0x0000000000400000-0x00000000009A0000-memory.dmp INDICATOR_EXE_Packed_Loader - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 2756 explorer.exe 4928 spoolsv.exe 2572 svchost.exe 224 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs
pid Process 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 2756 explorer.exe 2756 explorer.exe 4928 spoolsv.exe 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 2572 svchost.exe 224 spoolsv.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2756 explorer.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2756 explorer.exe 2572 svchost.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2572 svchost.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2572 svchost.exe 2572 svchost.exe 2756 explorer.exe 2756 explorer.exe 2572 svchost.exe 2572 svchost.exe 2756 explorer.exe 2756 explorer.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2572 svchost.exe 2756 explorer.exe 2756 explorer.exe 2572 svchost.exe 2572 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2756 explorer.exe 2572 svchost.exe - Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 2756 explorer.exe 2756 explorer.exe 2756 explorer.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 224 spoolsv.exe 224 spoolsv.exe 224 spoolsv.exe 2756 explorer.exe 2756 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2756 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 91 PID 1244 wrote to memory of 2756 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 91 PID 1244 wrote to memory of 2756 1244 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe 91 PID 2756 wrote to memory of 4928 2756 explorer.exe 92 PID 2756 wrote to memory of 4928 2756 explorer.exe 92 PID 2756 wrote to memory of 4928 2756 explorer.exe 92 PID 4928 wrote to memory of 2572 4928 spoolsv.exe 93 PID 4928 wrote to memory of 2572 4928 spoolsv.exe 93 PID 4928 wrote to memory of 2572 4928 spoolsv.exe 93 PID 2572 wrote to memory of 224 2572 svchost.exe 94 PID 2572 wrote to memory of 224 2572 svchost.exe 94 PID 2572 wrote to memory of 224 2572 svchost.exe 94 PID 2572 wrote to memory of 4084 2572 svchost.exe 95 PID 2572 wrote to memory of 4084 2572 svchost.exe 95 PID 2572 wrote to memory of 4084 2572 svchost.exe 95 PID 2572 wrote to memory of 2240 2572 svchost.exe 106 PID 2572 wrote to memory of 2240 2572 svchost.exe 106 PID 2572 wrote to memory of 2240 2572 svchost.exe 106 PID 2572 wrote to memory of 1556 2572 svchost.exe 108 PID 2572 wrote to memory of 1556 2572 svchost.exe 108 PID 2572 wrote to memory of 1556 2572 svchost.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe"C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:224
-
-
C:\Windows\SysWOW64\at.exeat 04:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4084
-
-
C:\Windows\SysWOW64\at.exeat 04:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2240
-
-
C:\Windows\SysWOW64\at.exeat 04:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1556
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:4280
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 1.4MB
- SHA256 55306933c699d7282adaa6da22b632884a55b92960501a4fd4807665eff03f4c
- MD5 347dd2f7159ce6f6916029768d44dab9
- SHA1 dedea565a4d8b3260dd706df27cb6c1ba1334b74
- SHA512 d61a3b421d96d44e6ef632adb89b5a838abcbc7756616d2f837353f06bc9f68261255348dc9a7cd7878bca861d8e36093a8fff2d382501b2525c3703547634de
- SSDEEP 24576:T9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlME:T9UX1uBx4mYo83vOSeyeaKr2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 1.4MB
- SHA256 19e6f8152772fffa1fc4917630db28c64ff6d06dea50f511f179dadbdb087bf1
- MD5 590eacac67c0a4c43bfbc4d1615affbf
- SHA1 e0525f2e53db3b983d44c5394b216aa0dacdbbe8
- SHA512 e80cd0111e0eea46f7319db0ef4951a624ef9bc7955f4b42934b95a406097d20e5bcea3042f395a5c7458b339685c97df6c6218ecc6404c29d18132fb374b013
- SSDEEP 24576:T9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMR:T9UX1uBx4mYo83vOSeyeaKr3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 1.4MB
- SHA256 22fa150e8763e98be62460d2845610174c978462228fcb527f6b6e49cb7a55e8
- MD5 9384c7510591ee7e3c91a32bb9311605
- SHA1 d00346ff465705d231fba2fe6eded50b48673698
- SHA512 1531de1665456d298866cc99e2557cf51d6cb0d6dc11c82529684c6b4105a50baa9f1e59d1e8a0e3eb2a0dac7fdad820208caf6f8abfb1b92dfad196860e7e82
- SSDEEP 24576:T9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMy:T9UX1uBx4mYo83vOSeyeaKro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 1.4MB
- SHA256 a4c33399deecca307877ce6247d908a815a698e4e8a81054cf991964d83d0860
- MD5 2a92318840dedf4a42e6f704da12a557
- SHA1 91d642186faaa256ae06f8073ebcc3ce7c0f24cb
- SHA512 fdfbaf387ac6364758e1f1866aa64d06a9b967c633a742770adf1e06a87e0ca2113987694cc75f860340c761349076f5d51d8e0b7f8c0d31e8bff0cee95e1592
- SSDEEP 24576:T9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMo:T9UX1uBx4mYo83vOSeyeaKre
- MD5 SHA1 SHA512 SSDEEP