1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
Size

65KB
MD5

1d1275474c3899ae196df734c4582c81
SHA1

85efd6e5e11fc27d7df0fa1b04b8bdf43933df41
SHA256

1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db
SHA512

09f78ab5772ee1ea659fd0253b137df19d241b634a2b6878f2bec72e4ad568629ab961887bb4305cc48382aa4aa62a73fbfc7c37f8256bf71e091f12323fa7d5
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouf:7WNqkOJWmo1HpM0MkTUmuf

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2968	explorer.exe
2480	spoolsv.exe
2580	svchost.exe
2432	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1836	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
1836	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
2968	explorer.exe
2968	explorer.exe
2480	spoolsv.exe
2480	spoolsv.exe
2580	svchost.exe
2580	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1836	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
2968	explorer.exe
2968	explorer.exe
2968	explorer.exe
2580	svchost.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe
2968	explorer.exe
2580	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2968	explorer.exe
2580	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1836	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
1836	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
2968	explorer.exe
2968	explorer.exe
2480	spoolsv.exe
2480	spoolsv.exe
2580	svchost.exe
2580	svchost.exe
2432	spoolsv.exe
2432	spoolsv.exe
2968	explorer.exe
2968	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2968	1836	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe	28
PID 1836 wrote to memory of 2968	1836	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe	28
PID 1836 wrote to memory of 2968	1836	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe	28
PID 1836 wrote to memory of 2968	1836	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe	28
PID 2968 wrote to memory of 2480	2968	explorer.exe	29
PID 2968 wrote to memory of 2480	2968	explorer.exe	29
PID 2968 wrote to memory of 2480	2968	explorer.exe	29
PID 2968 wrote to memory of 2480	2968	explorer.exe	29
PID 2480 wrote to memory of 2580	2480	spoolsv.exe	30
PID 2480 wrote to memory of 2580	2480	spoolsv.exe	30
PID 2480 wrote to memory of 2580	2480	spoolsv.exe	30
PID 2480 wrote to memory of 2580	2480	spoolsv.exe	30
PID 2580 wrote to memory of 2432	2580	svchost.exe	31
PID 2580 wrote to memory of 2432	2580	svchost.exe	31
PID 2580 wrote to memory of 2432	2580	svchost.exe	31
PID 2580 wrote to memory of 2432	2580	svchost.exe	31
PID 2580 wrote to memory of 1216	2580	svchost.exe	32
PID 2580 wrote to memory of 1216	2580	svchost.exe	32
PID 2580 wrote to memory of 1216	2580	svchost.exe	32
PID 2580 wrote to memory of 1216	2580	svchost.exe	32
PID 2580 wrote to memory of 1688	2580	svchost.exe	36
PID 2580 wrote to memory of 1688	2580	svchost.exe	36
PID 2580 wrote to memory of 1688	2580	svchost.exe	36
PID 2580 wrote to memory of 1688	2580	svchost.exe	36
PID 2580 wrote to memory of 916	2580	svchost.exe	38
PID 2580 wrote to memory of 916	2580	svchost.exe	38
PID 2580 wrote to memory of 916	2580	svchost.exe	38
PID 2580 wrote to memory of 916	2580	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
"C:\Users\Admin\AppData\Local\Temp\1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2968
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1216
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1688
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
953796924437a5a8d9824b78ccd95d25

SHA1
91f8c8e818330bdb0df88075be481ac2596a47da

SHA256
9cd6c15680955983dd342d09c64dd2fdb1dffa31356d51f1b92622020c1b121e

SHA512
cfa5758f2babe08bc9eda18201e4948d16a3f6ec66a03d3c9a25bcfa40859d4ab5dab064cc85784f2a60982c61e3dd414a2feffe65429c65b189dbc82e468078

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
65KB

MD5
fbd2befd986356b5a9cc7e9d13a7fc03

SHA1
3d7400725115aef5b4e3bd82d9f15506c4a0dc2c

SHA256
ee5a29d617e9f166da80c79e248c5a98516f4044770f60c4461711fcc5447ef4

SHA512
cd860a0fbd7ecc81ce3e5fe5c796ac618fb67b2e170305dea93dc96080e3a4d8fdf34214a39344e1176007e0c0ecd5fa0f7fe65dd49a723172e3005af25d61f8

Download Submit
C:\Windows\system\svchost.exe

Filesize
65KB

MD5
d450346578d824cb54cb441bc173ecf8

SHA1
ff932e67fc05818321f103753317904a46c361b7

SHA256
68a4dbdf65e8a39352679980de3f1c65982a344b3bf603913cd5fb2f0ae36a21

SHA512
8db4214627703d6005ca5e839dc12f8909855902f902319b48b062000bac4a9847d1871ab225c39ab111ec7efbc51f1139f212b80c267d0784971febabd56f75

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
b2e5c977caa853d7c1c4922a7d316bca

SHA1
296fdef44afab18cf1c807f5b1be197467382665

SHA256
a9f628ade836478a7151e48c4f4bbabb3db8d9da1cacc8c448e10e3eb453405a

SHA512
8ddecc385f9a6dc956796ba393eeef3b364488987d01a44ff3415235b201079bdced87b88b8c96fba034d1237a9eeafeddb08bfd93e6f09c390138b56522e515

Download Submit
memory/1836-13-0x0000000002860000-0x0000000002891000-memory.dmp

Filesize
196KB

Download
memory/1836-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1836-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1836-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1836-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1836-7-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1836-62-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1836-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1836-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2432-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2432-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2480-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2480-55-0x0000000002560000-0x0000000002591000-memory.dmp

Filesize
196KB

Download
memory/2480-54-0x0000000002560000-0x0000000002591000-memory.dmp

Filesize
196KB

Download
memory/2480-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2580-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2580-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2580-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2968-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2968-36-0x00000000026A0000-0x00000000026D1000-memory.dmp

Filesize
196KB

Download
memory/2968-26-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2968-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2968-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2968-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2968-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download