947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8

Analysis

max time kernel
150s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
Size

65KB
MD5

3288b56ce2e4cd447873a0a54f69feb7
SHA1

852e60f47b3ef3b9715ef4a4bb7a5b029ea52865
SHA256

947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8
SHA512

4d3b81155818b9a6d45b472c2362ac9d58b3dbb2fff2714117aac6c15ff13cfe5552d98e0e47f59c5c07d78118e5ba946799b7488845b7655897d3af97442b74
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oum:7WNqkOJWmo1HpM0MkTUmum

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4376	explorer.exe
5060	spoolsv.exe
4868	svchost.exe
4976	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5780	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
5780	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
4376	explorer.exe
4376	explorer.exe
4376	explorer.exe
4376	explorer.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe
4376	explorer.exe
4376	explorer.exe
4868	svchost.exe
4868	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4376	explorer.exe
4868	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5780	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
5780	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
4376	explorer.exe
4376	explorer.exe
5060	spoolsv.exe
5060	spoolsv.exe
4868	svchost.exe
4868	svchost.exe
4976	spoolsv.exe
4976	spoolsv.exe
4376	explorer.exe
4376	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 4376	5780	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe	84
PID 5780 wrote to memory of 4376	5780	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe	84
PID 5780 wrote to memory of 4376	5780	947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe	84
PID 4376 wrote to memory of 5060	4376	explorer.exe	85
PID 4376 wrote to memory of 5060	4376	explorer.exe	85
PID 4376 wrote to memory of 5060	4376	explorer.exe	85
PID 5060 wrote to memory of 4868	5060	spoolsv.exe	86
PID 5060 wrote to memory of 4868	5060	spoolsv.exe	86
PID 5060 wrote to memory of 4868	5060	spoolsv.exe	86
PID 4868 wrote to memory of 4976	4868	svchost.exe	88
PID 4868 wrote to memory of 4976	4868	svchost.exe	88
PID 4868 wrote to memory of 4976	4868	svchost.exe	88
PID 4868 wrote to memory of 4192	4868	svchost.exe	89
PID 4868 wrote to memory of 4192	4868	svchost.exe	89
PID 4868 wrote to memory of 4192	4868	svchost.exe	89
PID 4868 wrote to memory of 2984	4868	svchost.exe	109
PID 4868 wrote to memory of 2984	4868	svchost.exe	109
PID 4868 wrote to memory of 2984	4868	svchost.exe	109
PID 4868 wrote to memory of 3088	4868	svchost.exe	121
PID 4868 wrote to memory of 3088	4868	svchost.exe	121
PID 4868 wrote to memory of 3088	4868	svchost.exe	121

C:\Users\Admin\AppData\Local\Temp\947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe
"C:\Users\Admin\AppData\Local\Temp\947349588e2770905f2dc3d1c3fe1ff4515ca4cab16a34e9fd2a1f5bf9bd3bb8.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4376
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4192
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2984
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
1399801a5daf4bd05288756053ed4893

SHA1
9dfc0554969915e37d96ca42bb8db87c5c6a9009

SHA256
2e45e42ae6fde24b52eabe0a3b4d161ee03284a4d905b67231b744fc3bb601dc

SHA512
0062228aa9d9f78f879f4a42b51fab79f0ce2a11ec77565e805ce709dd397dffce28516cba8cd2cb0983bc4f0c3f808531186099424865e6ddd64d72b1012746

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
65KB

MD5
7802fa8be2065d3dc61823484aaf7b2d

SHA1
cd6d0d56ae2c7ad7a3457d06d2e9b4222f475c4b

SHA256
75a716d484087b53d781f6d60066aecd506715e5a9be0451c34c38ea9b15837c

SHA512
d40e07e519e3e92862f452b50ae35dd959a9b0931bba1525fa55b5e301c69537e6aa0842301475cb0c7d8f078de774325144f20159a7cb52127a7ab8286b364f

Download Submit
C:\Windows\System\svchost.exe

Filesize
65KB

MD5
47dbd91d7df86d4fd3a17a204099d312

SHA1
8896c6f1613bbc19aa839e1c60c3fa87e1b738ac

SHA256
8958a900b2cb7c2541435188a8219af067909d04de41a60b88d4c79255ebd3e3

SHA512
5ca91bed685027b2b311691f56bf08e85af691a095c6d5534b14740546254cb732d11401b292d19f994c7467fec146c74a3b9da504cd264e84ffd39b6676f4b6

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
65KB

MD5
74d02f420f0bc7e83c7151e0ac71fd80

SHA1
9cdc62634bfc21627adcb484d36af064f3231b71

SHA256
8ff3d9f251d371d6f240a736a65e4cd5d2172f44db1a34d4eee6d8eada08d8b3

SHA512
21b8340c5739d17caa13ae6eadc6778d317894e13c9ae85f98c2715be82436601865cf00b91c3b0760caf29ca4bed800032bb36d475151dda55c1278b565e543

Download Submit
memory/4376-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4376-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4376-14-0x0000000074FC0000-0x000000007511D000-memory.dmp

Filesize
1.4MB

Download
memory/4376-17-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4376-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4868-38-0x0000000074FC0000-0x000000007511D000-memory.dmp

Filesize
1.4MB

Download
memory/4868-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4868-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4976-50-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4976-44-0x0000000074FC0000-0x000000007511D000-memory.dmp

Filesize
1.4MB

Download
memory/5060-29-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5060-30-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5060-25-0x0000000074FC0000-0x000000007511D000-memory.dmp

Filesize
1.4MB

Download
memory/5060-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5780-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5780-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5780-58-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/5780-57-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/5780-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/5780-2-0x0000000074FC0000-0x000000007511D000-memory.dmp

Filesize
1.4MB

Download
memory/5780-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5780-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download