5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392

Analysis

max time kernel
150s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe
Size

200KB
MD5

33aece73372bdf70fcb0960502fea900
SHA1

351e24ebe399c233028e545881c448cdeaf7d8bc
SHA256

5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392
SHA512

5a35f12fdfe6d5b9fea8402053afacc871790c5705b906847d493e9a63a843c8e3389f8f794bc606c1275cf05f32ade4906f9f6959c0ba826cedd438b1c77925
SSDEEP

3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9i6:7vEN2U+T6i5LirrllHy4HUcMQY6C9i6

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1488	explorer.exe
4868	spoolsv.exe
3240	svchost.exe
3676	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4480	5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe
4480	5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe
1488	explorer.exe
1488	explorer.exe
1488	explorer.exe
1488	explorer.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe
1488	explorer.exe
1488	explorer.exe
3240	svchost.exe
3240	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1488	explorer.exe
3240	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4480	5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe
4480	5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe
1488	explorer.exe
1488	explorer.exe
4868	spoolsv.exe
4868	spoolsv.exe
3240	svchost.exe
3240	svchost.exe
3676	spoolsv.exe
3676	spoolsv.exe
1488	explorer.exe
1488	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 1488	4480	5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe	81
PID 4480 wrote to memory of 1488	4480	5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe	81
PID 4480 wrote to memory of 1488	4480	5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe	81
PID 1488 wrote to memory of 4868	1488	explorer.exe	83
PID 1488 wrote to memory of 4868	1488	explorer.exe	83
PID 1488 wrote to memory of 4868	1488	explorer.exe	83
PID 4868 wrote to memory of 3240	4868	spoolsv.exe	84
PID 4868 wrote to memory of 3240	4868	spoolsv.exe	84
PID 4868 wrote to memory of 3240	4868	spoolsv.exe	84
PID 3240 wrote to memory of 3676	3240	svchost.exe	85
PID 3240 wrote to memory of 3676	3240	svchost.exe	85
PID 3240 wrote to memory of 3676	3240	svchost.exe	85
PID 3240 wrote to memory of 4124	3240	svchost.exe	86
PID 3240 wrote to memory of 4124	3240	svchost.exe	86
PID 3240 wrote to memory of 4124	3240	svchost.exe	86
PID 3240 wrote to memory of 4980	3240	svchost.exe	97
PID 3240 wrote to memory of 4980	3240	svchost.exe	97
PID 3240 wrote to memory of 4980	3240	svchost.exe	97
PID 3240 wrote to memory of 2156	3240	svchost.exe	99
PID 3240 wrote to memory of 2156	3240	svchost.exe	99
PID 3240 wrote to memory of 2156	3240	svchost.exe	99

C:\Users\Admin\AppData\Local\Temp\5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe
"C:\Users\Admin\AppData\Local\Temp\5f72d11a754f7185b8eb411c5fa0afe9ba31ee72c0383bfaaf08cc25503a6392.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1488
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3676
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4124
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4980
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
216KB

MD5
e5a869623a3a91ad9c5ce96081a83fa3

SHA1
68bc32e4de18cfeb014f6ec63bc55299f4d91344

SHA256
1d7d927531e3b3d50edc270ae2047082af576ebe4f4ba9c60c445edde478d023

SHA512
70cfd78406a5f26f7b996b249871fefdf53bb005918447b0a03322275aaed0d743cbbf5cb468f928cb548b523fb9ab10023b9c7e6e1361cc7d46e7b937d1ce43

Download Submit
C:\Windows\System\explorer.exe

Filesize
216KB

MD5
de07bd52fa266cc0d9f38f52bb22911c

SHA1
607cca422f7a283cb79e8a79be4697e6de088c6d

SHA256
82f36718a066c38379e49181e5035bbc68dd46d9739a33f1e44f114d7ca6c599

SHA512
b46f99046c1b0960e761570435f3a51761aed522b4731739dff9a5b4ad99501893d004744657a479b8f4b4677b597f281eff43730b2abe050d5aa4273c09c0b1

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
216KB

MD5
0d40655b71cfa18a60aa4402f4523ba4

SHA1
538745baa9f253852eac5d7026ccb37f40ee3996

SHA256
bbfb2d30e9c9a4d7d0a0abcbb6e1b5af8716b842ddf3977c95430d4b0cfabe37

SHA512
344260420b69fcd6e161cd15637b001f28e9b44e850300683e2d56363e5fdb55f12c88ae84207f84c6014a3bf04ac4ba77af016bbf9b4aa61dc5c7d9ad73613a

Download Submit
C:\Windows\System\svchost.exe

Filesize
216KB

MD5
2f6ba39bcfc1025544e21b1694480fd7

SHA1
23cbd655469bce312bc99e29eb9919400edd0552

SHA256
329429cde546c6068214120ac73cef99bf5fb192b462d469b5af905c4043ecca

SHA512
ee67b8058f65011c147d904d681725f5a46f1592c7aa7302c7076d418984372ccbc81dc85b2f5f6d4060459ce9629692006e440a4a5fd0af02cac8feac132d07

Download Submit
memory/1488-9-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3676-35-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4480-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4480-38-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4868-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download