Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
04/06/2024, 01:54
Behavioral task
behavioral1
Sample
b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe
- Size 69KB
- Sample240604-cbr8laaa78
- SHA256 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73
- MD5 662caade13e8e4916b54ccd4a6037d64
- SHA1 9b041029547ed8bb9527b03af24025cb63241f12
- SHA512 a0de95b2fba0c2143df83ab4207be759b91f17addc4795a1561bec8383c8cc38d05c5af72125fd7cd34400c6f3ca4de97be3c037373dfb3473c0c2b6e1bda8e2
- SSDEEP 1536:EJrFDMRyriCY/qXfatMp4Q2V6fIMxIpLi:0F8dCY85TE6fIMSRi
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - UPX dump on OEP (original entry point) 14 IoCs
resource yara_rule behavioral1/memory/2824-0-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0032000000015d12-6.dat UPX behavioral1/memory/2836-14-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0008000000015d83-21.dat UPX behavioral1/memory/2232-29-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0009000000015dca-41.dat UPX behavioral1/memory/2296-52-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2296-54-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2232-58-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2824-60-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000b000000015d9f-61.dat UPX behavioral1/memory/2836-62-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2664-63-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2836-72-0x0000000000400000-0x0000000000434000-memory.dmp UPX - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 2836 explorer.exe 2232 spoolsv.exe 2664 svchost.exe 2296 spoolsv.exe - Loads dropped DLL 8 IoCs
pid Process 2824 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe 2824 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe 2836 explorer.exe 2836 explorer.exe 2232 spoolsv.exe 2232 spoolsv.exe 2664 svchost.exe 2664 svchost.exe -
resource yara_rule behavioral1/memory/2824-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0032000000015d12-6.dat upx behavioral1/memory/2836-14-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000015d83-21.dat upx behavioral1/memory/2232-29-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0009000000015dca-41.dat upx behavioral1/memory/2296-52-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2296-54-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2232-58-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2824-60-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000b000000015d9f-61.dat upx behavioral1/memory/2836-62-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2664-63-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2836-72-0x0000000000400000-0x0000000000434000-memory.dmp upx - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2664 svchost.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2664 svchost.exe 2836 explorer.exe 2836 explorer.exe 2664 svchost.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2664 svchost.exe 2836 explorer.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2664 svchost.exe 2836 explorer.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2836 explorer.exe 2664 svchost.exe 2664 svchost.exe 2836 explorer.exe 2836 explorer.exe 2664 svchost.exe 2664 svchost.exe 2836 explorer.exe 2836 explorer.exe 2664 svchost.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe 2836 explorer.exe 2664 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2836 explorer.exe 2664 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2824 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe 2824 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe 2836 explorer.exe 2836 explorer.exe 2232 spoolsv.exe 2232 spoolsv.exe 2664 svchost.exe 2664 svchost.exe 2296 spoolsv.exe 2296 spoolsv.exe 2836 explorer.exe 2836 explorer.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2836 2824 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe 28 PID 2824 wrote to memory of 2836 2824 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe 28 PID 2824 wrote to memory of 2836 2824 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe 28 PID 2824 wrote to memory of 2836 2824 b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe 28 PID 2836 wrote to memory of 2232 2836 explorer.exe 29 PID 2836 wrote to memory of 2232 2836 explorer.exe 29 PID 2836 wrote to memory of 2232 2836 explorer.exe 29 PID 2836 wrote to memory of 2232 2836 explorer.exe 29 PID 2232 wrote to memory of 2664 2232 spoolsv.exe 30 PID 2232 wrote to memory of 2664 2232 spoolsv.exe 30 PID 2232 wrote to memory of 2664 2232 spoolsv.exe 30 PID 2232 wrote to memory of 2664 2232 spoolsv.exe 30 PID 2664 wrote to memory of 2296 2664 svchost.exe 31 PID 2664 wrote to memory of 2296 2664 svchost.exe 31 PID 2664 wrote to memory of 2296 2664 svchost.exe 31 PID 2664 wrote to memory of 2296 2664 svchost.exe 31 PID 2664 wrote to memory of 2512 2664 svchost.exe 32 PID 2664 wrote to memory of 2512 2664 svchost.exe 32 PID 2664 wrote to memory of 2512 2664 svchost.exe 32 PID 2664 wrote to memory of 2512 2664 svchost.exe 32 PID 2664 wrote to memory of 2800 2664 svchost.exe 36 PID 2664 wrote to memory of 2800 2664 svchost.exe 36 PID 2664 wrote to memory of 2800 2664 svchost.exe 36 PID 2664 wrote to memory of 2800 2664 svchost.exe 36 PID 2664 wrote to memory of 928 2664 svchost.exe 38 PID 2664 wrote to memory of 928 2664 svchost.exe 38 PID 2664 wrote to memory of 928 2664 svchost.exe 38 PID 2664 wrote to memory of 928 2664 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe"C:\Users\Admin\AppData\Local\Temp\b6c2df057d0e11dabe39fe1800793d5b0b59d249f0ac0e353092fb9fb5c0ec73.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2296
-
-
C:\Windows\SysWOW64\at.exeat 01:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2512
-
-
C:\Windows\SysWOW64\at.exeat 01:57 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2800
-
-
C:\Windows\SysWOW64\at.exeat 01:58 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:928
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 69KB
- SHA256 bbd1803837492a94f01f960a1b5421d347b1a7a07150d772b7a9c3d9403a0ef9
- MD5 1694b78f9dff9dd0bcebb81366be0ebb
- SHA1 cebf06a27fe30dd7050c896d014015c135d38a65
- SHA512 6e294c308a4d9ac7e84710f6cc04a2886fa8a972881c61b9f8481ccbe58ffba1a218bec2f128835264412380f06caed06d3deeeb1baac0b4df50166b149c668f
- SSDEEP 1536:EJrFDMRyriCY/qXfatMp4Q2V6fIMxIpLc:0F8dCY85TE6fIMSRc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system\svchost.exe
- Size 69KB
- SHA256 2feb10cc2aebc0b8a52b56e0684a6e95e29223492a9fa99aea4bf0ee41c247f7
- MD5 49c0eec9f25d11b54d8c8d21241e918e
- SHA1 31342fbead461873e6fd9447f4748f3963f8476b
- SHA512 ecedf27993548ebc02ab219043e4249c0275e4ebedf030998c191fc023b76d6af8f258a5d97483f3411c65994d24662694ed5e8735b997139f124b03d576d3de
- SSDEEP 1536:EJrFDMRyriCY/qXfatMp4Q2V6fIMxIpL7:0F8dCY85TE6fIMSR7
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\system\explorer.exe
- Size 70KB
- SHA256 c723b7c470819a92eb59231395e59948056d9c5a8aa11c34089a018ee64c9e7b
- MD5 6c609eaa8b1bf9299b41ae36b6e82b65
- SHA1 cf39190db97b2c219b4b0058d7c5c5791b667cf0
- SHA512 ca66c5428d3ff0e162a7dbd2920042d8fa97a9c922be19be26c2548d5c1ee906a3385569470cd3a038b81533c2383916bfe7e2acd1bc61ed7c91ee0a16748ce8
- SSDEEP 1536:EJrFDMRyriCY/qXfatMp4Q2V6fIMxIpLw:0F8dCY85TE6fIMSRw
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\system\spoolsv.exe
- Size 70KB
- SHA256 e377596924a32d2981985e3fec9f22328aa2beee6671851299271351a2850f7d
- MD5 f063dc259e13994805623318e13a0dd1
- SHA1 152ee055240b06736f3aa83022937076dad7f4e8
- SHA512 08349333a96a3ad48ac85bf8d43fc536dd15a3abe569b8a0dcecafce3251e00687f319afc1a1ee284835eb9701524c817857bdd382182dc662f31ccb1d39c2b5
- SSDEEP 1536:EJrFDMRyriCY/qXfatMp4Q2V6fIMxIpLV:0F8dCY85TE6fIMSRV
- MD5 SHA1 SHA512 SSDEEP