Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 03:43

General

  • Target

    d539ff89bbc13ff88f9ccff3a62e751f0019b9a127149679ef6e41572e939b95.exe

  • Size

    65KB

  • MD5

    2514b1ea9181355c60f8fecd2079d520

  • SHA1

    a29773eabbd64ff10fabe570a288c44231c69c87

  • SHA256

    d539ff89bbc13ff88f9ccff3a62e751f0019b9a127149679ef6e41572e939b95

  • SHA512

    c3942b709634cebe0a899440ed3de53e1c3b21c4c9aacc17056c61372378099c532c7277e8aac109f64b5b832c577280c20afee871b7a93affe45320c43f7d66

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oujjjjjjjjjjjjjjjjjjj4:7WNqkOJWmo1HpM0MkTUmu0

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d539ff89bbc13ff88f9ccff3a62e751f0019b9a127149679ef6e41572e939b95.exe
    "C:\Users\Admin\AppData\Local\Temp\d539ff89bbc13ff88f9ccff3a62e751f0019b9a127149679ef6e41572e939b95.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1660
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4160
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4440
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2896
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4804
          • C:\Windows\SysWOW64\at.exe
            at 03:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:3952
            • C:\Windows\SysWOW64\at.exe
              at 03:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2316
              • C:\Windows\SysWOW64\at.exe
                at 03:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:2632

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          65KB

          MD5

          7761195f0761755119d5b6310667308d

          SHA1

          fd90e3d94c1f37914ab0f19c321120da7473a609

          SHA256

          0cd3c1991420479292f5de5246285966772eaf3569d330da459f174c45618cc4

          SHA512

          3c65dfa71e81d07daa8eff20cd96287717e7c3700a9b94032ba3215796a19095cc07e987ef6b4fac20e5e73c26d3e98f2a1f4f9520cf84d9aa71b5ea10699bd8

        • C:\Windows\System\explorer.exe

          Filesize

          65KB

          MD5

          436c7fe1a851dbaa6bebf486def031b3

          SHA1

          ed35cf2526a67197172e26966c2c4aa2c6ed9fdd

          SHA256

          5e7dd74dc0294f8c5205c9d4df2da277003872b44836dbc87e299fd483939288

          SHA512

          1ef057f5e4d8bbd94697ac36eab2bad4a511d33027ac969827dd98b9433e7b31abf406e6ae3d0f8f14568e9f2c0f04ab15fae1d222dcdf68cff2c4e74b528e8a

        • C:\Windows\System\spoolsv.exe

          Filesize

          65KB

          MD5

          0df70d2f465aa663d91be6525bc9352f

          SHA1

          8be6c71eea5949a66ee778415f93eee498c963cc

          SHA256

          3df9e94153d659bee758f6bf1d997cb2049f171ef6286e5de2a956eecef57732

          SHA512

          27107e6abde5d66521e4160dcb9a117454596b228d0fff2b1ac738432f039e8576806a827dc5eb9d8a8337e8f902a1937ec59d2e11bc59ca414656777427973a

        • C:\Windows\System\svchost.exe

          Filesize

          65KB

          MD5

          fdce0c49408d062de8e23530beb5443d

          SHA1

          1c52b98e379e8ad39d4b6c094e870e965639b645

          SHA256

          6597a841bafed6fdedd4de4dddfc4a5baff423fb4c57af03ef8cb008aa3e4a04

          SHA512

          cf00d17f2a424d0b7b4d4becbc6d68c71a7061ba865499a6eb82858490f4ef2f4460da1b66178da0aabffd0ff2180c907c450faa2e39c6babee68a696a563069

        • memory/1660-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1660-2-0x0000000075190000-0x00000000752ED000-memory.dmp

          Filesize

          1.4MB

        • memory/1660-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/1660-58-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/1660-5-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/1660-56-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/1660-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1660-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2896-41-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2896-37-0x0000000075190000-0x00000000752ED000-memory.dmp

          Filesize

          1.4MB

        • memory/2896-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4160-71-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4160-60-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4160-13-0x0000000075190000-0x00000000752ED000-memory.dmp

          Filesize

          1.4MB

        • memory/4160-15-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4160-16-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4440-30-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4440-53-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4440-26-0x0000000075190000-0x00000000752ED000-memory.dmp

          Filesize

          1.4MB

        • memory/4440-25-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4804-54-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4804-44-0x0000000075190000-0x00000000752ED000-memory.dmp

          Filesize

          1.4MB