88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe
Size

65KB
MD5

249ba99e1d6bcdf41cbdf4cdf399cc32
SHA1

bdbf762bfa0fa0c010cf213ff4b7d9dc15225007
SHA256

88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b
SHA512

f672eb869318f810adac40efab1701bfa8e4c92ff0c9a53c134dc85f6af49210233df9c14058cbda9234ff9d7f10ca95e47056d09e4778addedeccd075a50b9a
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuYUUUUUUUUUUUUUUUUUUW:7WNqkOJWmo1HpM0MkTUmuD

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2496	explorer.exe
2616	spoolsv.exe
2564	svchost.exe
2512	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2916	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe
2916	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe
2496	explorer.exe
2496	explorer.exe
2616	spoolsv.exe
2616	spoolsv.exe
2564	svchost.exe
2564	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2916	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe
2496	explorer.exe
2496	explorer.exe
2496	explorer.exe
2564	svchost.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe
2496	explorer.exe
2564	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2496	explorer.exe
2564	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2916	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe
2916	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe
2496	explorer.exe
2496	explorer.exe
2616	spoolsv.exe
2616	spoolsv.exe
2564	svchost.exe
2564	svchost.exe
2512	spoolsv.exe
2512	spoolsv.exe
2496	explorer.exe
2496	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2496	2916	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe	28
PID 2916 wrote to memory of 2496	2916	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe	28
PID 2916 wrote to memory of 2496	2916	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe	28
PID 2916 wrote to memory of 2496	2916	88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe	28
PID 2496 wrote to memory of 2616	2496	explorer.exe	29
PID 2496 wrote to memory of 2616	2496	explorer.exe	29
PID 2496 wrote to memory of 2616	2496	explorer.exe	29
PID 2496 wrote to memory of 2616	2496	explorer.exe	29
PID 2616 wrote to memory of 2564	2616	spoolsv.exe	30
PID 2616 wrote to memory of 2564	2616	spoolsv.exe	30
PID 2616 wrote to memory of 2564	2616	spoolsv.exe	30
PID 2616 wrote to memory of 2564	2616	spoolsv.exe	30
PID 2564 wrote to memory of 2512	2564	svchost.exe	31
PID 2564 wrote to memory of 2512	2564	svchost.exe	31
PID 2564 wrote to memory of 2512	2564	svchost.exe	31
PID 2564 wrote to memory of 2512	2564	svchost.exe	31
PID 2564 wrote to memory of 2476	2564	svchost.exe	32
PID 2564 wrote to memory of 2476	2564	svchost.exe	32
PID 2564 wrote to memory of 2476	2564	svchost.exe	32
PID 2564 wrote to memory of 2476	2564	svchost.exe	32
PID 2564 wrote to memory of 1908	2564	svchost.exe	36
PID 2564 wrote to memory of 1908	2564	svchost.exe	36
PID 2564 wrote to memory of 1908	2564	svchost.exe	36
PID 2564 wrote to memory of 1908	2564	svchost.exe	36
PID 2564 wrote to memory of 3012	2564	svchost.exe	38
PID 2564 wrote to memory of 3012	2564	svchost.exe	38
PID 2564 wrote to memory of 3012	2564	svchost.exe	38
PID 2564 wrote to memory of 3012	2564	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe
"C:\Users\Admin\AppData\Local\Temp\88dab02e4ffb1c4e314e41ef7683fa5f8d7c20ce6c8995e0c93c521af642465b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2496
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2476
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1908
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
253e447bda37017f5f1867115bb030d1

SHA1
ea284068b81e0238e72cc3713a28ad83cb83a133

SHA256
ccd46a625584c0cc21d9e3e451c2b62a056ea6091db94c477bafe7afd34395ea

SHA512
c0e07bcca2126f3026da338fa5b37c939edd5162d14d9add6d842c60dd5955c249d81c13d5818e49d08120b5a037f7043b95cc4c5cd0ec9098ec0f796280f711

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
65KB

MD5
acfaad999adc9f6d852f8a45934397ae

SHA1
01ce7289a6ff2f8ba99a0b229124e48839720907

SHA256
4c042b5d005d756c6509b06ee67cb052877dd94f48933a04bcfcef8c476559b9

SHA512
ea63535de9c966581501d731de5089ff61df0e4c12bd46fefb57aecf9c2f2deeddd506d133745dca6db9402c84a2359c2e2f17a8e576f1c0b7c51e30ed516975

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
6cfbb496e1e2976a47cd387a41ae56f2

SHA1
1ae9360858a7e150564a9a76f9e48ebbd190a4d0

SHA256
9353b5d2e471ea8f7521eb15b2756f753ac59d05745126b1faab326e95af1945

SHA512
899506f6df7bc9ae61210420dda1eb236b8f295ef07e5bf4cd94b04605270c1d3ebcf7c2216b202e378b1bfac0fdddceefbe4ccbcf4ec5fb1e737e2f6dd7fe0d

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
6258b08c4e2ec5bfc77f885c6d23256a

SHA1
c6ba9c1751255099c05eb6bc8e87cdf4dbfce243

SHA256
6b5db5a25c2f6d02996969b8b1840a5fbbbe6eff685ad74c73217694a4dc0324

SHA512
fde8c49cefc3910f707bcc00eac7151ab4c7421b05c30aae5cf5521790b8d76ccfbda5f97c30359f1be7f1745707753d4658cf2e9b815d4fb9e692c8ecb94452

Download Submit
memory/2496-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2496-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2496-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2496-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2496-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2496-31-0x0000000003230000-0x0000000003261000-memory.dmp

Filesize
196KB

Download
memory/2512-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2512-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-67-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2564-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-66-0x0000000001E10000-0x0000000001E41000-memory.dmp

Filesize
196KB

Download
memory/2564-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-39-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2616-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2916-18-0x0000000003100000-0x0000000003131000-memory.dmp

Filesize
196KB

Download
memory/2916-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2916-65-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2916-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2916-17-0x0000000003100000-0x0000000003131000-memory.dmp

Filesize
196KB

Download
memory/2916-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2916-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2916-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2916-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2916-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download