abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe
Size 66KB
Sample240603-cm42jagh77
SHA256 abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051
MD5 35e87c7ebd527a000763e1c4a5715e6c
SHA1 c9bc9d346fee2369161913f13778a56c9af122bb
SHA512 fc08230f2acf726d90f927877566e5fc5cb30ee889eebaa4abddc29f5bb993bb4a02f7b41c09aedf65a0d77ad60f7d02079083678afd354387b7f74c8f73798e
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi8:IeklMMYJhqezw/pXzH9i8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3564	explorer.exe
4172	spoolsv.exe
1104	svchost.exe
4280	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3220	abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe
3220	abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
1104	svchost.exe
1104	svchost.exe
1104	svchost.exe
1104	svchost.exe
3564	explorer.exe
3564	explorer.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
1104	svchost.exe
3564	explorer.exe
3564	explorer.exe
1104	svchost.exe
1104	svchost.exe
3564	explorer.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe
3564	explorer.exe
1104	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3564	explorer.exe
1104	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3220	abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe
3220	abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe
3564	explorer.exe
3564	explorer.exe
4172	spoolsv.exe
4172	spoolsv.exe
1104	svchost.exe
1104	svchost.exe
4280	spoolsv.exe
4280	spoolsv.exe
3564	explorer.exe
3564	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 3564	3220	abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe	90
PID 3220 wrote to memory of 3564	3220	abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe	90
PID 3220 wrote to memory of 3564	3220	abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe	90
PID 3564 wrote to memory of 4172	3564	explorer.exe	91
PID 3564 wrote to memory of 4172	3564	explorer.exe	91
PID 3564 wrote to memory of 4172	3564	explorer.exe	91
PID 4172 wrote to memory of 1104	4172	spoolsv.exe	92
PID 4172 wrote to memory of 1104	4172	spoolsv.exe	92
PID 4172 wrote to memory of 1104	4172	spoolsv.exe	92
PID 1104 wrote to memory of 4280	1104	svchost.exe	93
PID 1104 wrote to memory of 4280	1104	svchost.exe	93
PID 1104 wrote to memory of 4280	1104	svchost.exe	93
PID 1104 wrote to memory of 1944	1104	svchost.exe	94
PID 1104 wrote to memory of 1944	1104	svchost.exe	94
PID 1104 wrote to memory of 1944	1104	svchost.exe	94
PID 1104 wrote to memory of 3588	1104	svchost.exe	105
PID 1104 wrote to memory of 3588	1104	svchost.exe	105
PID 1104 wrote to memory of 3588	1104	svchost.exe	105
PID 1104 wrote to memory of 876	1104	svchost.exe	107
PID 1104 wrote to memory of 876	1104	svchost.exe	107
PID 1104 wrote to memory of 876	1104	svchost.exe	107

C:\Users\Admin\AppData\Local\Temp\abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe
"C:\Users\Admin\AppData\Local\Temp\abff5b64e660b1771726a46979a8f51568ebbf7f1516e0b484b32efb6a230051.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3564
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1944
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3588
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 c51bde5392d6f99b0c5035ce007fa1900c9b56f3d8448bf27357e1998748c4d4
MD5 6be70e58b9d3494de7d9b5608c999451
SHA1 4e71750d9b3ecebbe261e157f98e4be0c5ab98bb
SHA512 fed18b762bc5d4561179b569a6deefb4e831d3492b74f139681db58a3f8ea2a99e920cafe1bb195d0df8b7c2ca579e1bd6a16b6b3d0e56141a20fa2891109619
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiL:IeklMMYJhqezw/pXzH9iL
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 66KB
SHA256 f94008b0ff01c44c372091aeb8d30356befcc4a52a7171538c30cbe70efced7a
MD5 649857c958f937345c9b9ee64d8170db
SHA1 8d3798487fded0aef7e38c2000a4cc7a2e64121a
SHA512 2415b560dc5423e2c0b8bc772cf966eaceaee7dc3181fa655d57888ec621a265afec84e92d07533da45fbbc6d808b8e68e01c2b63206f1ddc63fe0c6f4274c5a
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiO:IeklMMYJhqezw/pXzH9iO
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 03ca709583ba7f78abfc8139167d6049e9e8b176be53783cc551ad3eff70e705
MD5 c7cc4f792e6bb62f0a974ab5744b1106
SHA1 ead4733f70eb649fd093424ce81b0a82ebb1a659
SHA512 410daf4762b535bab32f4c6fd85b881dc1569ab9c07d5d314733e86e3b639cedc3ef9fc826d6da8c4240121a57523e4e65769c84556e39a6d69bb860df279a94
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiy:IeklMMYJhqezw/pXzH9iy
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 7446d6c313c43bda6907b8207bb677c043d685c51c09982e9479956b98062d95
MD5 a2735373666d9bdc429ae0d72182551f
SHA1 a40939bc89435131ca4f213fadb2a7bd84fff1b0
SHA512 ac9e0d84208d49f4994b0a24d05fea7956a44f214ef961974c40ad8b9e5852bfa65c86d501ffe81468532a4a24197b2e9366c06ae6bb5134048af7c8a5a240b4
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXip:IeklMMYJhqezw/pXzH9ip
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1104-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1104-37-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1104-38-0x0000000075370000-0x00000000754CD000-memory.dmp

Download

memory/3220-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/3220-2-0x0000000075370000-0x00000000754CD000-memory.dmp

Download

memory/3220-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3220-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3220-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3220-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/3220-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3220-56-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/3220-36-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/3564-17-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3564-14-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3564-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3564-15-0x0000000075370000-0x00000000754CD000-memory.dmp

Download

memory/3564-71-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4172-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4172-26-0x0000000075370000-0x00000000754CD000-memory.dmp

Download

memory/4280-49-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4280-44-0x0000000075370000-0x00000000754CD000-memory.dmp

Download