Analysis
- max time kernel
150s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe
- Size 206KB
- Sample240603-c8faasge5y
- SHA256 b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c
- MD5 a75185365e26659cf8909ea6f946484c
- SHA1 354cc4cbdfa69a8a43794072e284a95cfe5477b9
- SHA512 cdedc8d6ddadb2f5b8c66ee98f8e6afbf9c30f535d5929225dca090f092ef50fe788332ebc6bffbd7988844e312ea67075650580f89d976799a76dab2355b8b0
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLk:5vEN2U+T6i5LirrllHy4HUcMQY6Kk
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 1692 explorer.exe 2012 spoolsv.exe 1004 svchost.exe 3632 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe 3204 b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe 1692 explorer.exe 1692 explorer.exe 1692 explorer.exe 1692 explorer.exe 1692 explorer.exe 1692 explorer.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1004 svchost.exe 1004 svchost.exe 1004 svchost.exe 1692 explorer.exe 1692 explorer.exe 1004 svchost.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1692 explorer.exe 1004 svchost.exe 1004 svchost.exe 1692 explorer.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1004 svchost.exe 1004 svchost.exe 1692 explorer.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1004 svchost.exe 1692 explorer.exe 1692 explorer.exe 1004 svchost.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe 1692 explorer.exe 1004 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1692 explorer.exe 1004 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3204 b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe 3204 b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe 1692 explorer.exe 1692 explorer.exe 2012 spoolsv.exe 2012 spoolsv.exe 1004 svchost.exe 1004 svchost.exe 3632 spoolsv.exe 3632 spoolsv.exe 1692 explorer.exe 1692 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3204 wrote to memory of 1692 3204 b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe 81 PID 3204 wrote to memory of 1692 3204 b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe 81 PID 3204 wrote to memory of 1692 3204 b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe 81 PID 1692 wrote to memory of 2012 1692 explorer.exe 82 PID 1692 wrote to memory of 2012 1692 explorer.exe 82 PID 1692 wrote to memory of 2012 1692 explorer.exe 82 PID 2012 wrote to memory of 1004 2012 spoolsv.exe 83 PID 2012 wrote to memory of 1004 2012 spoolsv.exe 83 PID 2012 wrote to memory of 1004 2012 spoolsv.exe 83 PID 1004 wrote to memory of 3632 1004 svchost.exe 84 PID 1004 wrote to memory of 3632 1004 svchost.exe 84 PID 1004 wrote to memory of 3632 1004 svchost.exe 84 PID 1004 wrote to memory of 4268 1004 svchost.exe 85 PID 1004 wrote to memory of 4268 1004 svchost.exe 85 PID 1004 wrote to memory of 4268 1004 svchost.exe 85 PID 1004 wrote to memory of 3544 1004 svchost.exe 95 PID 1004 wrote to memory of 3544 1004 svchost.exe 95 PID 1004 wrote to memory of 3544 1004 svchost.exe 95 PID 1004 wrote to memory of 4924 1004 svchost.exe 97 PID 1004 wrote to memory of 4924 1004 svchost.exe 97 PID 1004 wrote to memory of 4924 1004 svchost.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe"C:\Users\Admin\AppData\Local\Temp\b62a22fa4f0c1aac13cfc571a67acecdd39b6c13ad9dc5f2b590efb9b92e859c.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3632
-
-
C:\Windows\SysWOW64\at.exeat 02:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4268
-
-
C:\Windows\SysWOW64\at.exeat 02:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3544
-
-
C:\Windows\SysWOW64\at.exeat 02:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4924
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 c5c61cdabedc7d05cb75fe45a9a28b27fe0229412d543c66e177c79824ba649a
- MD5 1962e6cb2a9bd350119310754911bcbf
- SHA1 1124cc3ee4b748715768d9b63e345715055a1237
- SHA512 92782f1bb2d045e7d5ae0ba6c1b4459f0f3f471abdcbe4258d4e14be1603d08d744f39a821760ae169616475db029164b1cb37750993f04b2a0e3bf3d57c5d3b
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL4:5vEN2U+T6i5LirrllHy4HUcMQY6K4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 f37717ec231cc16849a20f154649b1658e3d1642f94004377dddebcd46ee77ea
- MD5 c3c152f4cc27c6fd850ec2acb7fd0ab1
- SHA1 0c490dd38de7dfd62b50094eef6eb97af63450bb
- SHA512 4ea088ac9260302fd77b307d767fe493255c264b12b79b7eb28fd252052a3aca64ac80634bf8fba953881b085830a3b61670fb9be4c855b6a0629cce46432ba7
- SSDEEP 6144:5vEN2U+T6i5LirrllHy4HUcMQY6KXeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeei:RENN+T5xYrllrU7QY6KXeeeeeeeeeeeh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 8552077c44a04e85d0ac69985bdbcaf1eb4da153bb20709abb9f05e36e0d052b
- MD5 38e0336c5dfa57e91efe2a3428c5796a
- SHA1 5bfc6ae4fed5d4cb15ae7b388b0d76e08e086bf1
- SHA512 5f61d8d2d373a3ba189edf0e5e18815fc701da6f7938c6e1fee57c3aa8e5fdde02d95465900b815dd4b6f7d708b0a76b04b854efc67c43b499209b0335e05060
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL2:5vEN2U+T6i5LirrllHy4HUcMQY6K2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 cece616294d5f83aee5ec06ebbd135e80c66e984deef403f91d67faf83ed12cc
- MD5 4b5d7dc3767d01ac7719786c99494fca
- SHA1 77e13f77e893a6218da7f89bd2e21bcbf5d3532d
- SHA512 0c93ef15ff9bf68f83d7f60133e49e302951e5c92928999c4da0831166a51234576431d165290fb522dbc4b3d785dbb8eafb74df3a7b6728eb7b600244bd5f6b
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLJ:5vEN2U+T6i5LirrllHy4HUcMQY6KJ
- MD5 SHA1 SHA512 SSDEEP