947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
Size

65KB
MD5

3288b56ce2e4cd447873a0a54f69feb7
SHA1

852e60f47b3ef3b9715ef4a4bb7a5b029ea52865
SHA256

947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8
SHA512

4d3b81155818b9a6d45b472c2362ac9d58b3dbb2fff2714117aac6c15ff13cfe5552d98e0e47f59c5c07d78118e5ba946799b7488845b7655897d3af97442b74
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oum:7WNqkOJWmo1HpM0MkTUmum

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2860	explorer.exe
2716	spoolsv.exe
2548	svchost.exe
2752	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2936	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
2936	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
2860	explorer.exe
2860	explorer.exe
2716	spoolsv.exe
2716	spoolsv.exe
2548	svchost.exe
2548	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2936	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
2860	explorer.exe
2860	explorer.exe
2860	explorer.exe
2860	explorer.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2860	explorer.exe
2860	explorer.exe
2548	svchost.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2860	explorer.exe
2548	svchost.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2860	explorer.exe
2548	svchost.exe
2548	svchost.exe
2860	explorer.exe
2860	explorer.exe
2548	svchost.exe
2548	svchost.exe
2860	explorer.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2860	explorer.exe
2548	svchost.exe
2548	svchost.exe
2860	explorer.exe
2860	explorer.exe
2548	svchost.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2860	explorer.exe
2548	svchost.exe
2548	svchost.exe
2860	explorer.exe
2860	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2860	explorer.exe
2548	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2936	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
2936	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
2860	explorer.exe
2860	explorer.exe
2716	spoolsv.exe
2716	spoolsv.exe
2548	svchost.exe
2548	svchost.exe
2752	spoolsv.exe
2752	spoolsv.exe
2860	explorer.exe
2860	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2860	2936	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe	28
PID 2936 wrote to memory of 2860	2936	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe	28
PID 2936 wrote to memory of 2860	2936	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe	28
PID 2936 wrote to memory of 2860	2936	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe	28
PID 2860 wrote to memory of 2716	2860	explorer.exe	29
PID 2860 wrote to memory of 2716	2860	explorer.exe	29
PID 2860 wrote to memory of 2716	2860	explorer.exe	29
PID 2860 wrote to memory of 2716	2860	explorer.exe	29
PID 2716 wrote to memory of 2548	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2548	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2548	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2548	2716	spoolsv.exe	30
PID 2548 wrote to memory of 2752	2548	svchost.exe	31
PID 2548 wrote to memory of 2752	2548	svchost.exe	31
PID 2548 wrote to memory of 2752	2548	svchost.exe	31
PID 2548 wrote to memory of 2752	2548	svchost.exe	31
PID 2548 wrote to memory of 1604	2548	svchost.exe	32
PID 2548 wrote to memory of 1604	2548	svchost.exe	32
PID 2548 wrote to memory of 1604	2548	svchost.exe	32
PID 2548 wrote to memory of 1604	2548	svchost.exe	32
PID 2548 wrote to memory of 1512	2548	svchost.exe	36
PID 2548 wrote to memory of 1512	2548	svchost.exe	36
PID 2548 wrote to memory of 1512	2548	svchost.exe	36
PID 2548 wrote to memory of 1512	2548	svchost.exe	36
PID 2548 wrote to memory of 912	2548	svchost.exe	38
PID 2548 wrote to memory of 912	2548	svchost.exe	38
PID 2548 wrote to memory of 912	2548	svchost.exe	38
PID 2548 wrote to memory of 912	2548	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
"C:\Users\Admin\AppData\Local\Temp\947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2860
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1604
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1512
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
12814e7461c36938bc36b09e6ab09e0c

SHA1
a87f0b16a0785632f7888845d674b29ab6dc5c0e

SHA256
e951717ce15c1529946dfe3403f2f3b26fdcb647109fc6664e0efd04e9872681

SHA512
28e18a8b471e39e9cd213aaf3cf46492c094159e7337725df910c298b413cb8b3d1b837030808dd7cfe9181c26adefd603fe5f859203fee08243da83133717d7

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
28e942b76eb7f9c4c01499b164926aff

SHA1
df1f1ace9023fa1e5dc18dc2cfe6a370d5a8d8c2

SHA256
4f48cc9ba75afe21bf7c014141c86de0a8b5e6c583ef02b4a7e6a579a71c550c

SHA512
d40a4cd915c9885fcd8ead004ab42a2e03ceba14b81ef0beb600cba40dc63fb0f8fad1f76092407455c0f3a81d6429ba66e838f857521892097c30de3e1f7d31

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
ec7164f726d59a00ac42700f55f17cc2

SHA1
da3bec09c8c8c35cf208ef28a2bfc285d1bef7bb

SHA256
ef5bd1f92288f37b2740264c33f0249af67ddb855a1d591a79ad3882a07fcd65

SHA512
eda76db59bedb0b8e1f98e2f697e67ce03d07920dc210aa7bf99e1ba11094ee007111a89f9433cdb69bd9e9b7d559fcd4f426a2c30907fa40100e6613bec0ffc

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
4dccc857a7dbb104034b972dbb812c9a

SHA1
b69b7ac39896065bc9bc17098adb857a65169057

SHA256
a045f62d16c62fd8786fc2e51446788e728e0464dd2ee32decf9df0623934ec3

SHA512
7ef3e0c584606a86a3537c3b97df7ab4595bde7d417f5347cf460325919681ab2bdd5f85f754946886348b74d285459706685afd7238cd1663687b7510f88d04

Download Submit
memory/2548-90-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-64-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-70-0x0000000001DA0000-0x0000000001DD1000-memory.dmp

Filesize
196KB

Download
memory/2548-71-0x0000000001DA0000-0x0000000001DD1000-memory.dmp

Filesize
196KB

Download
memory/2548-57-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2716-39-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2716-38-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-56-0x0000000002780000-0x00000000027B1000-memory.dmp

Filesize
196KB

Download
memory/2716-45-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-50-0x0000000002780000-0x00000000027B1000-memory.dmp

Filesize
196KB

Download
memory/2716-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2752-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2752-73-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2752-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2860-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2860-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2860-99-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2860-31-0x00000000007B0000-0x00000000007E1000-memory.dmp

Filesize
196KB

Download
memory/2860-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2860-37-0x00000000007B0000-0x00000000007E1000-memory.dmp

Filesize
196KB

Download
memory/2860-88-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2860-87-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2936-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2936-18-0x0000000002680000-0x00000000026B1000-memory.dmp

Filesize
196KB

Download
memory/2936-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2936-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2936-85-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2936-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2936-69-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2936-17-0x0000000002680000-0x00000000026B1000-memory.dmp

Filesize
196KB

Download
memory/2936-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2936-63-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2936-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download