Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 03:45
Static task
static1
Behavioral task
behavioral1
Sample
ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe
Resource
win10v2004-20240508-en
General
-
Target
ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe
-
Size
200KB
-
MD5
540639790e808383dff1db73ffb3953f
-
SHA1
904848d13943b6e5f30ff759976af770d4514863
-
SHA256
ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5
-
SHA512
eb461f3131221cc3ffa97087c7846a96193c6446e8f5ef3726cbc3e4fc9839b640fb1d9781ce216cbce38f926e51661148b4006747085b2831e1a67d89ec240e
-
SSDEEP
3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9it:7vEN2U+T6i5LirrllHy4HUcMQY6C9it
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 2000 explorer.exe 2632 spoolsv.exe 2884 svchost.exe 2528 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 1916 ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe 1916 ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe 2000 explorer.exe 2000 explorer.exe 2632 spoolsv.exe 2632 spoolsv.exe 2884 svchost.exe 2884 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2884 svchost.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe 2000 explorer.exe 2884 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2000 explorer.exe 2884 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1916 ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe 1916 ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe 2000 explorer.exe 2000 explorer.exe 2632 spoolsv.exe 2632 spoolsv.exe 2884 svchost.exe 2884 svchost.exe 2528 spoolsv.exe 2528 spoolsv.exe 2000 explorer.exe 2000 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2000 1916 ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe 28 PID 1916 wrote to memory of 2000 1916 ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe 28 PID 1916 wrote to memory of 2000 1916 ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe 28 PID 1916 wrote to memory of 2000 1916 ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe 28 PID 2000 wrote to memory of 2632 2000 explorer.exe 29 PID 2000 wrote to memory of 2632 2000 explorer.exe 29 PID 2000 wrote to memory of 2632 2000 explorer.exe 29 PID 2000 wrote to memory of 2632 2000 explorer.exe 29 PID 2632 wrote to memory of 2884 2632 spoolsv.exe 30 PID 2632 wrote to memory of 2884 2632 spoolsv.exe 30 PID 2632 wrote to memory of 2884 2632 spoolsv.exe 30 PID 2632 wrote to memory of 2884 2632 spoolsv.exe 30 PID 2884 wrote to memory of 2528 2884 svchost.exe 31 PID 2884 wrote to memory of 2528 2884 svchost.exe 31 PID 2884 wrote to memory of 2528 2884 svchost.exe 31 PID 2884 wrote to memory of 2528 2884 svchost.exe 31 PID 2884 wrote to memory of 2516 2884 svchost.exe 32 PID 2884 wrote to memory of 2516 2884 svchost.exe 32 PID 2884 wrote to memory of 2516 2884 svchost.exe 32 PID 2884 wrote to memory of 2516 2884 svchost.exe 32 PID 2884 wrote to memory of 2168 2884 svchost.exe 36 PID 2884 wrote to memory of 2168 2884 svchost.exe 36 PID 2884 wrote to memory of 2168 2884 svchost.exe 36 PID 2884 wrote to memory of 2168 2884 svchost.exe 36 PID 2884 wrote to memory of 2480 2884 svchost.exe 38 PID 2884 wrote to memory of 2480 2884 svchost.exe 38 PID 2884 wrote to memory of 2480 2884 svchost.exe 38 PID 2884 wrote to memory of 2480 2884 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe"C:\Users\Admin\AppData\Local\Temp\ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2528
-
-
C:\Windows\SysWOW64\at.exeat 03:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2516
-
-
C:\Windows\SysWOW64\at.exeat 03:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2168
-
-
C:\Windows\SysWOW64\at.exeat 03:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2480
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5ad0b1517c683966373dad4d29cba2037
SHA1e29a417a733386ace012840d5f1bf8e3dd43c445
SHA256c428f2ec35b80a7ecaef78f445c5e73ba66fb534c9534ea9a59c41bb2336684e
SHA512ad0bb463f337f8ca47a911a85120bb9eed790c7c2de367b5f90eac3babb02830b614642abc7b1fdb7ccdd56364c21f761c4a15c1371676b41a21ff5603970d75
-
Filesize
216KB
MD587433a3d13c13c63a7645935fc98b541
SHA1bd72cc6b1452ce2be60cc0f008f180d34be6adb8
SHA256d73550a61be42e7914fed65f86443e68edd3bce3bfe189a7be8aa2665cbc0fcf
SHA512e75ad321e132b86ff0c4f619e4138e0866a8c6c265970bcf0c2e12ba7099d2100e1f3925cc94aeca557ef1d2ad77d2f57efb600c1e62ab21940c5d4eb56e8498
-
Filesize
216KB
MD5f47785a07398c6e7b31b8d1e77fba527
SHA199c8ef5826e2bea6f4cef73c72c9112c76d532bd
SHA256c8f6b28c00a984ee73cecab05fa344d9939fec5beba04bba70bfa4ecb9503402
SHA5128e0176e6a5f568c7223cd8f85794ad01b3b5f215df71f35b7a1abc56d61ae91772fecd9047f372cb410c4f0911315ae2e9b32f2e85ebcfc35ba5a749ba237467
-
Filesize
216KB
MD53fe021c9d9012681346a919191ea45c9
SHA10c14341bc61e0d8af023104d394e0844f62de122
SHA2567c58b49529aa52d63b8459fd4f8e1f3d3f05aaa746bee8b687882eed93f58e5e
SHA512590e5d5bf0bb8e347fe7b7366e05a96cfcc46899c69d8f45918d188c70f1c63c8cc0a6ead9e0f7305be14f3cfe4ee69fa67a054cdcc799e64dd339b090dff591