Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 03:45

General

  • Target

    ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe

  • Size

    200KB

  • MD5

    540639790e808383dff1db73ffb3953f

  • SHA1

    904848d13943b6e5f30ff759976af770d4514863

  • SHA256

    ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5

  • SHA512

    eb461f3131221cc3ffa97087c7846a96193c6446e8f5ef3726cbc3e4fc9839b640fb1d9781ce216cbce38f926e51661148b4006747085b2831e1a67d89ec240e

  • SSDEEP

    3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9it:7vEN2U+T6i5LirrllHy4HUcMQY6C9it

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe
    "C:\Users\Admin\AppData\Local\Temp\ca787487f1eec4b1b1bf1fd4e7edecae1cde4f6eb854695bc05f8e25695577e5.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3860
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:764
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3972
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3152
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1624
          • C:\Windows\SysWOW64\at.exe
            at 03:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2264
            • C:\Windows\SysWOW64\at.exe
              at 03:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1188
              • C:\Windows\SysWOW64\at.exe
                at 03:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:656

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          216KB

          MD5

          4bdb42638e3003efe509ec688fde214d

          SHA1

          9e3e2360bf6be4578d51728f8c88560e8e1af657

          SHA256

          679a13f26c1221e6c544026422f5740887dcf136af6a09377fc8ae175c6519dd

          SHA512

          b861b8bfeb6ca9cb787136f1c296156b82588e16e5a55ec7fb70b02959ce65135e31e4f54c97d77d35815f1d51f0d7786a05f5936bb5803b16f5f35a2325cd74

        • C:\Windows\System\explorer.exe

          Filesize

          216KB

          MD5

          87433a3d13c13c63a7645935fc98b541

          SHA1

          bd72cc6b1452ce2be60cc0f008f180d34be6adb8

          SHA256

          d73550a61be42e7914fed65f86443e68edd3bce3bfe189a7be8aa2665cbc0fcf

          SHA512

          e75ad321e132b86ff0c4f619e4138e0866a8c6c265970bcf0c2e12ba7099d2100e1f3925cc94aeca557ef1d2ad77d2f57efb600c1e62ab21940c5d4eb56e8498

        • C:\Windows\System\spoolsv.exe

          Filesize

          216KB

          MD5

          6006098cd175b07b15957316b0e7ef37

          SHA1

          96424f96b9f278aededefb6346b5b7297384b973

          SHA256

          8b11243e746ebd847427acb9d4fa51c3120b2fc515b1e9a073175c0c7cfeedb8

          SHA512

          f9032461cded31bf11f62a9b92dd4fbaf67fe94f35e39cf48ab954281d78c180e269a3e865dbf04bcf805c6bf01345495f78f6a6feb6567afeb526e11528a870

        • C:\Windows\System\svchost.exe

          Filesize

          216KB

          MD5

          b91bd1142afcb0af92e1cb392877a16a

          SHA1

          dbb487454dea546d8848eaa1337dc4fe8ea88c75

          SHA256

          142fa01cc22bafb73d0212956081829c0f433a2f71aed1e5c97edd1015542f4f

          SHA512

          30fa2494eb5ae7c4a6a35749c37a720753b047f02fd0bd0b56343d2093cc053fb97057635f14995b1c7abf5472ac57b52c559f22fe19a50eb8a893ad7cfee6e7

        • memory/1624-35-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3860-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3860-37-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3972-17-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3972-36-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB