36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe
Size

65KB
MD5

f34c59e9842a061d69e4cf7c3376ed6b
SHA1

05945b177f16120c8a1e708aeb3e4c34fb12d4f0
SHA256

36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50
SHA512

a4506e556db64874c6b3d2a7106e77bb97cfa91041fc3db6b9f90cc8b754525be9eec2de9ac55362d5613ed023e60e80c3e61939fde682135c373315339f3281
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oum:7WNqkOJWmo1HpM0MkTUmum

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2100	explorer.exe
2716	spoolsv.exe
2800	svchost.exe
2648	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2408	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe
2408	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe
2100	explorer.exe
2100	explorer.exe
2716	spoolsv.exe
2716	spoolsv.exe
2800	svchost.exe
2800	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2408	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe
2100	explorer.exe
2100	explorer.exe
2100	explorer.exe
2100	explorer.exe
2800	svchost.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe
2800	svchost.exe
2100	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2100	explorer.exe
2800	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2408	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe
2408	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe
2100	explorer.exe
2100	explorer.exe
2716	spoolsv.exe
2716	spoolsv.exe
2800	svchost.exe
2800	svchost.exe
2648	spoolsv.exe
2648	spoolsv.exe
2100	explorer.exe
2100	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2100	2408	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe	28
PID 2408 wrote to memory of 2100	2408	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe	28
PID 2408 wrote to memory of 2100	2408	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe	28
PID 2408 wrote to memory of 2100	2408	36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe	28
PID 2100 wrote to memory of 2716	2100	explorer.exe	29
PID 2100 wrote to memory of 2716	2100	explorer.exe	29
PID 2100 wrote to memory of 2716	2100	explorer.exe	29
PID 2100 wrote to memory of 2716	2100	explorer.exe	29
PID 2716 wrote to memory of 2800	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2800	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2800	2716	spoolsv.exe	30
PID 2716 wrote to memory of 2800	2716	spoolsv.exe	30
PID 2800 wrote to memory of 2648	2800	svchost.exe	31
PID 2800 wrote to memory of 2648	2800	svchost.exe	31
PID 2800 wrote to memory of 2648	2800	svchost.exe	31
PID 2800 wrote to memory of 2648	2800	svchost.exe	31
PID 2800 wrote to memory of 2684	2800	svchost.exe	32
PID 2800 wrote to memory of 2684	2800	svchost.exe	32
PID 2800 wrote to memory of 2684	2800	svchost.exe	32
PID 2800 wrote to memory of 2684	2800	svchost.exe	32
PID 2800 wrote to memory of 1560	2800	svchost.exe	36
PID 2800 wrote to memory of 1560	2800	svchost.exe	36
PID 2800 wrote to memory of 1560	2800	svchost.exe	36
PID 2800 wrote to memory of 1560	2800	svchost.exe	36
PID 2800 wrote to memory of 2144	2800	svchost.exe	38
PID 2800 wrote to memory of 2144	2800	svchost.exe	38
PID 2800 wrote to memory of 2144	2800	svchost.exe	38
PID 2800 wrote to memory of 2144	2800	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe
"C:\Users\Admin\AppData\Local\Temp\36c694d94e65408b05e8995078b32f08cd93269e8d5b6c43ef738f4af87d7e50.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2100
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2684
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1560
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
98d9c6c0be21ccb72e95cbac67902b2e

SHA1
150433a7d5196ed4fa138587540ea614294ca26f

SHA256
d2604fe77510a8bd2b46ff329544207e938a092b26559483d9b72049fc96766a

SHA512
718ad38bdac85e9615ce6ab298f3f63c739746d91bdfe13d631ae6a47cf66fd0d551fc4a4302e9cc8faaa3cac07ee203210d92b1aba432398e4217f35865d6e1

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
b05eb9ac657d3bb72b319293adbdb332

SHA1
5bff664088aea1ebad83ffbd520183a500cc6bfe

SHA256
0e8aa2e5b489f6e22d5a2fa8c31cd9430b81fbe41fc909342f538282b5eda954

SHA512
cd05d0b6482f231a7ac3847f2b60a53d8f468de1ddde1ff40c13f9f6efe73690255935ed170326c57ec0bcf739407b3d74a8ad90b2677990a87fcfc4f89c5884

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
c17ba8a316e52d34d2dc2e0f983f9f53

SHA1
72730e0e4f0d7aa000d46f31daeaa27c792b0e0e

SHA256
f2979ea9ae005f9410ac908a5c07e35ef6deb2b406b221bb19d58c9fb64ebdf5

SHA512
bee8852249467fa2831e19e23569dc527b7b5ece5f6c1fe1d666fd63a8dc97662fe5fc888046f6b342c9ce941091af55296c9a657b91ef11de59cb8fa3ca0f82

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
8b7466b8251838a2c0e2f6b5e92eb678

SHA1
840fc536d6ab11621a3a50fee12b286aa42c9882

SHA256
8b63b023abfdd4d79f7719327f8900abf17ca6159abcbcdd45a4d73ed9c1d4a5

SHA512
03ebfee9aec4c79b6ad1be8de6bad6bfbb37859f6de218672354d9cddfa9214acf022674043749abae31f65a9abf98b415dcd30f45a3380e22326a577395a648

Download Submit
memory/2100-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2100-35-0x00000000026C0000-0x00000000026F1000-memory.dmp

Filesize
196KB

Download
memory/2100-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2100-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2100-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2100-90-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2408-17-0x00000000026B0000-0x00000000026E1000-memory.dmp

Filesize
196KB

Download
memory/2408-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2408-76-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2408-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2408-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2408-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2408-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2408-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2408-77-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2648-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-63-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2648-69-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-55-0x0000000003160000-0x0000000003191000-memory.dmp

Filesize
196KB

Download
memory/2716-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2800-52-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2800-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download