b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe
Size 66KB
Sample240609-jfl1psff8z
SHA256 b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9
MD5 30499e35471d2d25d8f3e51504eb3505
SHA1 62913f2925b5ee54c51d5152d0dd66b677b19b90
SHA512 24de42e8375795e6aac9a0913b56077478d22bf42ac5393fa900cb7cbda370e24d066d96fc455f39c58a41d9a14ff5d1662f5d14d615599bf3342c413eea7ea2
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiu:IeklMMYJhqezw/pXzH9iu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2028	explorer.exe
2172	spoolsv.exe
3872	svchost.exe
4644	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4368	b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe
4368	b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe
2028	explorer.exe
2028	explorer.exe
3872	svchost.exe
3872	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2028	explorer.exe
3872	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4368	b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe
4368	b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe
2028	explorer.exe
2028	explorer.exe
2172	spoolsv.exe
2172	spoolsv.exe
3872	svchost.exe
3872	svchost.exe
4644	spoolsv.exe
4644	spoolsv.exe
2028	explorer.exe
2028	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2028	4368	b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe	80
PID 4368 wrote to memory of 2028	4368	b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe	80
PID 4368 wrote to memory of 2028	4368	b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe	80
PID 2028 wrote to memory of 2172	2028	explorer.exe	81
PID 2028 wrote to memory of 2172	2028	explorer.exe	81
PID 2028 wrote to memory of 2172	2028	explorer.exe	81
PID 2172 wrote to memory of 3872	2172	spoolsv.exe	82
PID 2172 wrote to memory of 3872	2172	spoolsv.exe	82
PID 2172 wrote to memory of 3872	2172	spoolsv.exe	82
PID 3872 wrote to memory of 4644	3872	svchost.exe	83
PID 3872 wrote to memory of 4644	3872	svchost.exe	83
PID 3872 wrote to memory of 4644	3872	svchost.exe	83
PID 3872 wrote to memory of 3128	3872	svchost.exe	84
PID 3872 wrote to memory of 3128	3872	svchost.exe	84
PID 3872 wrote to memory of 3128	3872	svchost.exe	84
PID 3872 wrote to memory of 4124	3872	svchost.exe	94
PID 3872 wrote to memory of 4124	3872	svchost.exe	94
PID 3872 wrote to memory of 4124	3872	svchost.exe	94
PID 3872 wrote to memory of 736	3872	svchost.exe	96
PID 3872 wrote to memory of 736	3872	svchost.exe	96
PID 3872 wrote to memory of 736	3872	svchost.exe	96

C:\Users\Admin\AppData\Local\Temp\b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe
"C:\Users\Admin\AppData\Local\Temp\b81b9bc3f4676dcc7cdf97b852a697c9cfa0b60cd226801bb977466b73b892d9.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2028
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4644
    - - C:\Windows\SysWOW64\at.exe
        
        at 07:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3128
    - - C:\Windows\SysWOW64\at.exe
        
        at 07:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4124
    - - C:\Windows\SysWOW64\at.exe
        
        at 07:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 129452905e37b7480b166cf4bcbc5e23183ac49d0fbb710666566d4e2acd446b
MD5 889584cda27850a0940b327fdafbfbe9
SHA1 9b5c5456ac6dc13fd062430dcbeda5376f6ad48c
SHA512 b6fc64824f735a7b2493f8572533a55ed8ecf01c790921e347ff51d54ab5a4ce156be69cb9c4a6c3ecb394d1f2646bf9457635d2729dde36be4cf760a6357978
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXin:IeklMMYJhqezw/pXzH9in
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \??\c:\windows\system\explorer.exe
Size 66KB
SHA256 12f605e35549edfcc2c686765d93e79ebfba4776cfc7d1e803c1be5256879957
MD5 a553bc872e4e06f68cce1c2b05491d41
SHA1 22115e8a54ee2c65b0bd14067522b39b00ff0a6e
SHA512 7c715dd2ce00e572fba5bda28754097e148e327ab57c72d046f7a30e542495d5f3e54180e32c338633730bce4082c287f95a6f846ecc2d790d3d8af74b3219be
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiI:IeklMMYJhqezw/pXzH9iI
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path \??\c:\windows\system\spoolsv.exe
Size 66KB
SHA256 41a2427717fcbb1e40a6c0ca9e9862d8a8117ebf9ffae6babaa1a668172c778d
MD5 084e251fd055cebf24ff79a419bf8f7f
SHA1 ae464fdba4359fef72c6aaf8084a85238865032b
SHA512 6cd068e296939c8fafcedc40a116d71f48543c6f26032c37e2c00b721fd26417c4a1f301471e760bef5f76c6e740001603982385e97afd1469d7c46f313854e7
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiB:IeklMMYJhqezw/pXzH9iB
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \??\c:\windows\system\svchost.exe
Size 66KB
SHA256 09795f1f5228ba93d298c1553a28d8b5546f7cd46a4905c828ff1225f36b2852
MD5 2957d43b3891eb61b9ee85871699e969
SHA1 f2d9dfc30a9441382acb369672a858ea855154bb
SHA512 6368b47aff6cc7e0d78f7ea8d9a21734baf11b13f86c5df012d574a33c385c48e1f33c815246cec9ac8bf0263d172204a1a5676082ec9036c90161eb8452c73c
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi+YYYYYYYYYYYYYYYYYYYY6:IeklMMYJhqezw/pXzH9i+YYYYYYYYYYq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2028-17-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2028-71-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2028-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2028-13-0x00000000752C0000-0x000000007541D000-memory.dmp

Download

memory/2172-29-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2172-24-0x00000000752C0000-0x000000007541D000-memory.dmp

Download

memory/2172-28-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2172-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3872-42-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3872-62-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3872-37-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3872-36-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3872-38-0x00000000752C0000-0x000000007541D000-memory.dmp

Download

memory/4368-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4368-56-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/4368-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4368-58-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4368-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4368-2-0x00000000752C0000-0x000000007541D000-memory.dmp

Download

memory/4368-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/4368-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4644-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4644-45-0x00000000752C0000-0x000000007541D000-memory.dmp

Download