Analysis
- max time kernel
150s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe
- Size 206KB
- Sample240603-e3wq7sbc9v
- SHA256 da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3
- MD5 b1fb949318c9c602d31f3b6b63fc18da
- SHA1 3fd6762c5a360bd0d75370f14cd1a8ebbc46d756
- SHA512 0c073823d53b5db43b4e6784724a45d247006e544cb04480d754bb8b83f7a25c3fc2cba2c9f91b6293669b8f07f353d322f57f96de45f70e2602116abfb3ab2e
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLq:5vEN2U+T6i5LirrllHy4HUcMQY6Kq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 3616 explorer.exe 3592 spoolsv.exe 2968 svchost.exe 1460 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2752 da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe 2752 da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe 3616 explorer.exe 3616 explorer.exe 3616 explorer.exe 3616 explorer.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe 3616 explorer.exe 3616 explorer.exe 2968 svchost.exe 2968 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3616 explorer.exe 2968 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2752 da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe 2752 da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe 3616 explorer.exe 3616 explorer.exe 3592 spoolsv.exe 3592 spoolsv.exe 2968 svchost.exe 2968 svchost.exe 1460 spoolsv.exe 1460 spoolsv.exe 3616 explorer.exe 3616 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2752 wrote to memory of 3616 2752 da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe 83 PID 2752 wrote to memory of 3616 2752 da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe 83 PID 2752 wrote to memory of 3616 2752 da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe 83 PID 3616 wrote to memory of 3592 3616 explorer.exe 84 PID 3616 wrote to memory of 3592 3616 explorer.exe 84 PID 3616 wrote to memory of 3592 3616 explorer.exe 84 PID 3592 wrote to memory of 2968 3592 spoolsv.exe 85 PID 3592 wrote to memory of 2968 3592 spoolsv.exe 85 PID 3592 wrote to memory of 2968 3592 spoolsv.exe 85 PID 2968 wrote to memory of 1460 2968 svchost.exe 86 PID 2968 wrote to memory of 1460 2968 svchost.exe 86 PID 2968 wrote to memory of 1460 2968 svchost.exe 86 PID 2968 wrote to memory of 4500 2968 svchost.exe 87 PID 2968 wrote to memory of 4500 2968 svchost.exe 87 PID 2968 wrote to memory of 4500 2968 svchost.exe 87 PID 2968 wrote to memory of 1332 2968 svchost.exe 104 PID 2968 wrote to memory of 1332 2968 svchost.exe 104 PID 2968 wrote to memory of 1332 2968 svchost.exe 104 PID 2968 wrote to memory of 2248 2968 svchost.exe 113 PID 2968 wrote to memory of 2248 2968 svchost.exe 113 PID 2968 wrote to memory of 2248 2968 svchost.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe"C:\Users\Admin\AppData\Local\Temp\da8ad84661349f94b16cdf06775e482835e083c0d22d35b08c41c81837b9f3a3.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\Windows\SysWOW64\at.exeat 04:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4500
-
-
C:\Windows\SysWOW64\at.exeat 04:31 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1332
-
-
C:\Windows\SysWOW64\at.exeat 04:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2248
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 5f350b0f155265ae883761cf9e74a49ee807f8edae0ad129dc405bcf2e31014e
- MD5 be9af9fae418662e389d086f39297055
- SHA1 c9149bda8762f6e080fb99bb0ddeb18006860c82
- SHA512 1a36df99d1349cc36fc9b264259efad85e0abb069a5557c631299c409a86d5b0df68f2993d9a18d4c165d54b9967f5f7be21c6e81ad370267976d5497ba7b4d5
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLy:5vEN2U+T6i5LirrllHy4HUcMQY6Ky
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 9967a15e4375e279cb9f8a99f150d0628cb4a4cbe238dd3450808888af20e05f
- MD5 9a21b94635880f49d560c513b688d050
- SHA1 fddd9debf02a2bebb23bd504d9c370a59174cb7e
- SHA512 bfa4d5d29a058c75b0cb879aa1707316f278d4b84c383101a68c18e3e4d42885ac3a1f875fd2d8ef413477a6a70c70012bbabc5a4e1be3c74dc335805b340e7a
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL1:5vEN2U+T6i5LirrllHy4HUcMQY6K1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 89cb2a4777f462f690d20d039bb4528c5b16e9fa0c627beb4937fa4d1e001b22
- MD5 d7ac649882a5301e4d2b0e1136c9ba8b
- SHA1 c17715d0655f901b94546db8da355e2a71941938
- SHA512 a25c3db3b9463eb01975b8de168959b5626cfbfed76679eac214fedc8559fafc5d6ff3a69df78d6cddda08ecf556874a9b3a8df31c4d600e6e00c14f4e00f229
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL3ssssssssssssssssssss+:5vEN2U+T6i5LirrllHy4HUcMQY6Ku
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system\explorer.exe
- Size 206KB
- SHA256 a6c6e1fbe5ce6f655989bf51908919ed871bb39793d95f7a6b693cb61267f71d
- MD5 eb7020364dbee1e70f389b1ea4494fcb
- SHA1 dd623095dd9f9b76348fdd7e85369dc48391b745
- SHA512 4d9c23f2f2c41768360282caae17f757171dee86535d1441653da76b01eb10c470c69c6cdbae36315a9374b832cb21d55d810ce440a0d61b9f7a97aca9f5af63
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLP:5vEN2U+T6i5LirrllHy4HUcMQY6KP
- MD5 SHA1 SHA512 SSDEEP