1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
Size

65KB
MD5

1d1275474c3899ae196df734c4582c81
SHA1

85efd6e5e11fc27d7df0fa1b04b8bdf43933df41
SHA256

1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db
SHA512

09f78ab5772ee1ea659fd0253b137df19d241b634a2b6878f2bec72e4ad568629ab961887bb4305cc48382aa4aa62a73fbfc7c37f8256bf71e091f12323fa7d5
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouf:7WNqkOJWmo1HpM0MkTUmuf

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2212	explorer.exe
464	spoolsv.exe
3236	svchost.exe
3280	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1600	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
1600	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
2212	explorer.exe
2212	explorer.exe
2212	explorer.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe
2212	explorer.exe
2212	explorer.exe
3236	svchost.exe
3236	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2212	explorer.exe
3236	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1600	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
1600	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
2212	explorer.exe
2212	explorer.exe
464	spoolsv.exe
464	spoolsv.exe
3236	svchost.exe
3236	svchost.exe
3280	spoolsv.exe
3280	spoolsv.exe
2212	explorer.exe
2212	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2212	1600	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe	92
PID 1600 wrote to memory of 2212	1600	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe	92
PID 1600 wrote to memory of 2212	1600	1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe	92
PID 2212 wrote to memory of 464	2212	explorer.exe	93
PID 2212 wrote to memory of 464	2212	explorer.exe	93
PID 2212 wrote to memory of 464	2212	explorer.exe	93
PID 464 wrote to memory of 3236	464	spoolsv.exe	94
PID 464 wrote to memory of 3236	464	spoolsv.exe	94
PID 464 wrote to memory of 3236	464	spoolsv.exe	94
PID 3236 wrote to memory of 3280	3236	svchost.exe	95
PID 3236 wrote to memory of 3280	3236	svchost.exe	95
PID 3236 wrote to memory of 3280	3236	svchost.exe	95
PID 3236 wrote to memory of 884	3236	svchost.exe	96
PID 3236 wrote to memory of 884	3236	svchost.exe	96
PID 3236 wrote to memory of 884	3236	svchost.exe	96
PID 3236 wrote to memory of 3816	3236	svchost.exe	107
PID 3236 wrote to memory of 3816	3236	svchost.exe	107
PID 3236 wrote to memory of 3816	3236	svchost.exe	107
PID 3236 wrote to memory of 1700	3236	svchost.exe	109
PID 3236 wrote to memory of 1700	3236	svchost.exe	109
PID 3236 wrote to memory of 1700	3236	svchost.exe	109

C:\Users\Admin\AppData\Local\Temp\1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe
"C:\Users\Admin\AppData\Local\Temp\1992ee7c173b73935b8006bd7fcab4afd7c8e046738fe41bc2235dd468d599db.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2212
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:464
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3280
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:884
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
5cf733ce339e239ae438f251f24e26ab

SHA1
09d4279f32d9fbbb0feaa050bdc25cd804966369

SHA256
2050aab64ffbf4e2be1b197b6ea3b807b4c46b3dd3114ca12ba4b65b6c7661e2

SHA512
d20d8a46307ef4dbb7cb61cb317ea111f3117501cb35993d1d6dc1e27d99331bda7a6130b622b5e206684d21ba1d9d283004e0f06a403e14a0bc43ded0538d87

Download Submit
C:\Windows\System\explorer.exe

Filesize
65KB

MD5
3b36799eb55a3b6ca64711e39c9e70f6

SHA1
29edd481c66e15b65407411386f652766b76dbc3

SHA256
8200936019f3df449963742c3944accb16a57f5efb1b4675fb9d9caf982b5e27

SHA512
eb663a070e66493827a9b4b690961355de036f2d6cb9295c83f812648aa6b3170bb0793d7dc020021ed3ba9fec4a3d6f0eb32baa155ab0943d42cc13ca66cf1b

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
65KB

MD5
763c55f8cde40c9d31d341b4c1f16643

SHA1
b980cf9ea89e8fd667aaf52d3a06afa021e3f92a

SHA256
5a386e8749ed758fd27cf718de21ecd3690433d49ae786bf1eeeca4b92334ef1

SHA512
f6a282709f28ee028b0d207b2c86feba06dbeeda650e469de4286d84088520729aa83ed861eeda9fc833883268fb16193f43a0f79eb8cb81780fdc2466890854

Download Submit
C:\Windows\System\svchost.exe

Filesize
65KB

MD5
774635e317fd1d4daf3a16c1c880c020

SHA1
d21652cc98db906a1f10a12fd4a848fe7479b3a1

SHA256
276b79561f2e4037882a678db4f1bcb68266ae83cc15d83ac9bfc5d876f349ca

SHA512
ee5a8f1afde1b3e483ae0497e6a1364190ec9a49173841b668370732e129b57defc5f77bd4c584862616c07e55456f7887910ffbe3cd67feb16e617ac2971eb2

Download Submit
memory/464-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/464-26-0x0000000074C40000-0x0000000074D9D000-memory.dmp

Filesize
1.4MB

Download
memory/464-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1600-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/1600-56-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1600-2-0x0000000074C40000-0x0000000074D9D000-memory.dmp

Filesize
1.4MB

Download
memory/1600-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1600-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1600-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1600-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1600-42-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/2212-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2212-14-0x0000000074C40000-0x0000000074D9D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2212-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2212-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3236-36-0x0000000074C40000-0x0000000074D9D000-memory.dmp

Filesize
1.4MB

Download
memory/3236-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3280-43-0x0000000074C40000-0x0000000074D9D000-memory.dmp

Filesize
1.4MB

Download
memory/3280-49-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download