6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe
Size

65KB
MD5

dabe7c8360385d6cfdd4a8024e4681e4
SHA1

ed478b3f38d989aa4d283274104b2f264bd20839
SHA256

6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5
SHA512

e28e3e79ac06ef9b7a87e7344600433710efeabf18ecab4781d9f6f25d416f27274189320fde203effaf522d1142b6379dfb49c78d6d0ec14c3da03a0a064902
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou6999999999999999999f:7WNqkOJWmo1HpM0MkTUmu6999999999d

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
3016	explorer.exe
2544	spoolsv.exe
2548	svchost.exe
2532	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2972	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe
2972	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe
3016	explorer.exe
3016	explorer.exe
2544	spoolsv.exe
2544	spoolsv.exe
2548	svchost.exe
2548	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2972	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe
3016	explorer.exe
3016	explorer.exe
3016	explorer.exe
2548	svchost.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe
3016	explorer.exe
2548	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3016	explorer.exe
2548	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2972	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe
2972	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe
3016	explorer.exe
3016	explorer.exe
2544	spoolsv.exe
2544	spoolsv.exe
2548	svchost.exe
2548	svchost.exe
2532	spoolsv.exe
2532	spoolsv.exe
3016	explorer.exe
3016	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3016	2972	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe	28
PID 2972 wrote to memory of 3016	2972	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe	28
PID 2972 wrote to memory of 3016	2972	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe	28
PID 2972 wrote to memory of 3016	2972	6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe	28
PID 3016 wrote to memory of 2544	3016	explorer.exe	29
PID 3016 wrote to memory of 2544	3016	explorer.exe	29
PID 3016 wrote to memory of 2544	3016	explorer.exe	29
PID 3016 wrote to memory of 2544	3016	explorer.exe	29
PID 2544 wrote to memory of 2548	2544	spoolsv.exe	30
PID 2544 wrote to memory of 2548	2544	spoolsv.exe	30
PID 2544 wrote to memory of 2548	2544	spoolsv.exe	30
PID 2544 wrote to memory of 2548	2544	spoolsv.exe	30
PID 2548 wrote to memory of 2532	2548	svchost.exe	31
PID 2548 wrote to memory of 2532	2548	svchost.exe	31
PID 2548 wrote to memory of 2532	2548	svchost.exe	31
PID 2548 wrote to memory of 2532	2548	svchost.exe	31
PID 2548 wrote to memory of 2772	2548	svchost.exe	32
PID 2548 wrote to memory of 2772	2548	svchost.exe	32
PID 2548 wrote to memory of 2772	2548	svchost.exe	32
PID 2548 wrote to memory of 2772	2548	svchost.exe	32
PID 2548 wrote to memory of 2224	2548	svchost.exe	36
PID 2548 wrote to memory of 2224	2548	svchost.exe	36
PID 2548 wrote to memory of 2224	2548	svchost.exe	36
PID 2548 wrote to memory of 2224	2548	svchost.exe	36
PID 2548 wrote to memory of 2104	2548	svchost.exe	38
PID 2548 wrote to memory of 2104	2548	svchost.exe	38
PID 2548 wrote to memory of 2104	2548	svchost.exe	38
PID 2548 wrote to memory of 2104	2548	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe
"C:\Users\Admin\AppData\Local\Temp\6ae8b56011c221d0a39d8dc845b2a5da940ca60489a4d544b1f58cfa4bf8a9c5.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3016
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2772
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2224
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
11d9bbc556c96da7e16349d15501fffa

SHA1
d74e85aa22596e07ad4512a195f3b1672c74ff0e

SHA256
91834ca05d1216663ab950418278164ba4beb6a7a62531ea7b9ecaf03f8051d9

SHA512
14632c5002c69587476b060ac9ba82e945ded9c9e67e13e743688b2c64862b70b3b8d3443b8a9fdc45dbc3d58240e1daf8647bc5e4aef55e7678a7fe30be5a3a

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
65KB

MD5
67e268181fb8b06a4e00ae4a5c12d633

SHA1
721b7ec7b2798625f5e86ea97812eed594fb28ac

SHA256
e0b80290c0e3184f029b09d01312381b2d6c4cc02f55b8b6941cd403ee147737

SHA512
590be0de0ed579c08a35740cd188419e20b2b102b4b55d907d41328d494709e48c9c55672c477228db311d8b8cdbc8f13ad42430e4cbc0da01ca15f834ebaf35

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
65KB

MD5
5d5adb7d659aff3a022e792f36a8dcc9

SHA1
bd30330ca6d0e7714159bf3797608a15b2bdec16

SHA256
9ce675320cb6e2a2dbbb76fec7fd266858ac7a63add7f106fa88e9b316d1b3d4

SHA512
249c0afbd5fac1e5347a30eac2c86b0d0462c9d999a057ccfa3e88a4eb233d87fb723c124e8ca9f29c74b0e72fab65df35cd9e169761efa83886f9bec078cf50

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
230f6d882b7fcc21fae530d620a9535a

SHA1
fdc68c72e635f93a0b04d0b629181d0c8a34165c

SHA256
0f061b1ed7e2ef29825270d485a97892c9d1c2af60e5e73ea074c2ae6303f50c

SHA512
2185539452a8024d9ba1e92e34b77219e9ab6d464a51cffdfc91d76500109292e2340b5bbe6d514c4ab7b01c5dc3dee15ed6003b8206d0d90730f22ad696ab7e

Download Submit
memory/2532-66-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2532-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2544-35-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2544-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2544-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2544-52-0x00000000025B0000-0x00000000025E1000-memory.dmp

Filesize
196KB

Download
memory/2544-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-85-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2548-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2972-79-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2972-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2972-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2972-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2972-17-0x00000000024C0000-0x00000000024F1000-memory.dmp

Filesize
196KB

Download
memory/2972-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2972-81-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2972-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2972-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3016-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3016-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3016-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3016-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3016-39-0x00000000032B0000-0x00000000032E1000-memory.dmp

Filesize
196KB

Download
memory/3016-94-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download