9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe
Size 66KB
Sample240604-ayjtmafa2v
SHA256 9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70
MD5 584b08bcdbfb5fdb85b77ac5d1d41ab9
SHA1 461a14cd6bb0fd081444c20dd540a45803434524
SHA512 2fd6ee4d95380e64f8865762c762b5bfa31bce3fec0209c613b0f378b19c1c352ecc1266bc7fdbae80454a650aa390ef766de0830315f14f3b6f9627fb73d5ee
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXitAEAEAEAEAEAEAEAEAEAE/:IeklMMYJhqezw/pXzH9itAEAEAEAEAEx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
4484	explorer.exe
2984	spoolsv.exe
1492	svchost.exe
3848	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4272	9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe
4272	9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
1492	svchost.exe
1492	svchost.exe
1492	svchost.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
1492	svchost.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
1492	svchost.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
1492	svchost.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
1492	svchost.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
1492	svchost.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
1492	svchost.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
4484	explorer.exe
1492	svchost.exe
4484	explorer.exe
1492	svchost.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
4484	explorer.exe
1492	svchost.exe
4484	explorer.exe
1492	svchost.exe
1492	svchost.exe
1492	svchost.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
1492	svchost.exe
4484	explorer.exe
1492	svchost.exe
4484	explorer.exe
1492	svchost.exe
4484	explorer.exe
1492	svchost.exe
4484	explorer.exe
1492	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4484	explorer.exe
1492	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4272	9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe
4272	9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe
4484	explorer.exe
4484	explorer.exe
2984	spoolsv.exe
2984	spoolsv.exe
1492	svchost.exe
1492	svchost.exe
3848	spoolsv.exe
3848	spoolsv.exe
4484	explorer.exe
4484	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4484	4272	9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe	82
PID 4272 wrote to memory of 4484	4272	9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe	82
PID 4272 wrote to memory of 4484	4272	9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe	82
PID 4484 wrote to memory of 2984	4484	explorer.exe	83
PID 4484 wrote to memory of 2984	4484	explorer.exe	83
PID 4484 wrote to memory of 2984	4484	explorer.exe	83
PID 2984 wrote to memory of 1492	2984	spoolsv.exe	84
PID 2984 wrote to memory of 1492	2984	spoolsv.exe	84
PID 2984 wrote to memory of 1492	2984	spoolsv.exe	84
PID 1492 wrote to memory of 3848	1492	svchost.exe	85
PID 1492 wrote to memory of 3848	1492	svchost.exe	85
PID 1492 wrote to memory of 3848	1492	svchost.exe	85
PID 1492 wrote to memory of 2160	1492	svchost.exe	87
PID 1492 wrote to memory of 2160	1492	svchost.exe	87
PID 1492 wrote to memory of 2160	1492	svchost.exe	87
PID 1492 wrote to memory of 3348	1492	svchost.exe	100
PID 1492 wrote to memory of 3348	1492	svchost.exe	100
PID 1492 wrote to memory of 3348	1492	svchost.exe	100
PID 1492 wrote to memory of 1628	1492	svchost.exe	102
PID 1492 wrote to memory of 1628	1492	svchost.exe	102
PID 1492 wrote to memory of 1628	1492	svchost.exe	102

C:\Users\Admin\AppData\Local\Temp\9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe
"C:\Users\Admin\AppData\Local\Temp\9a81ce1e7c9cd1af8594df42df21fdc239514e247cb41c62aeec8482c387ad70.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4484
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3848
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2160
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3348
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 0f3f3e701837bede3eae83f438fcee873f15493b4699819e8f05ae62e437992d
MD5 3823a2fb983f70f03e1c465e253a063e
SHA1 94aafb6a054ead529665a324ef879550c4c40f71
SHA512 2f538b2f49754b44d0745977047f34079b30ab9d508c937003fa7c9aadc6e027ff78783e3de97f57c5d7d4459234e1410f373f4e345fc4ce715e52ae6a4f6887
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXim:IeklMMYJhqezw/pXzH9im
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 fea660b94c6932c819eda34688e2ce8a3ca4203ac3e8d62e11a7951d0d0fea99
MD5 56dd0f4ba37cdf7ed1247b94c1d5b11c
SHA1 47acbe41c7bbe8fd7cba9eb286c5dca1be784e68
SHA512 1a8003cc7466cc35286a3615fd6f637363c7fb14e706481cae820e24554966279f95d6fafdd11b5cea0dd172d5c10ae2f518aa42e2128b7150ec629d160dafde
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi3:IeklMMYJhqezw/pXzH9i3
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 7250273e531e569c9aa6469125256acf48b13cf9c35acbcc77611ba638d80682
MD5 7c5f2195395df861405588fc83e4655c
SHA1 36161d1949f7450db52c0055755782cafab0b9b9
SHA512 8915413b468806891bee15a52c48cc6d0a322af58d56771734b8188fffd0857e33e416578bf835533b478bbf5db56387c9ba1a95fd6c8570db3352562c1604cd
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXixwwwwwwwwwwwwwwwwwwwwv:IeklMMYJhqezw/pXzH9ixwwwwwwwwwwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \??\c:\windows\system\explorer.exe
Size 66KB
SHA256 40c004a5bcfd8aef7870e9e8db0ff0724b999f921ae4788be438815be3f2dfff
MD5 e56918d88c601ad81e2ee31b38b313ef
SHA1 c3abcfe9978013645e5f7176efdc74d3f043f5be
SHA512 fe141344ac41c98037cfd2a0e72befe5e8d7b378afaca7caf7d1a7e508c2bcb91b717c5d486af2f1dd01871e968092ebe055772043e4d17c9e7733bfe1de5817
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiE:IeklMMYJhqezw/pXzH9iE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1492-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1492-37-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download

memory/1492-36-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2984-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2984-25-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download

memory/2984-29-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3848-43-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3848-50-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3848-44-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download

memory/4272-56-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4272-2-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download

memory/4272-5-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4272-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4272-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4272-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4272-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/4484-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4484-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4484-13-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download

memory/4484-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4484-69-0x0000000000400000-0x0000000000431000-memory.dmp

Download