49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe
Size

65KB
MD5

94ab93ffcd0e6b2d04ffc12dcc71a7b6
SHA1

2ea97e1684433771d31076576fbda8aa99feac20
SHA256

49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6
SHA512

d455d755633abd0754dea452a093bc816eaa1f01cfb95e6de154d3ca1529f41cb905836a804a672c16b428933bebca7cc8baa5506e87a8dd806686ca9d05ad55
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuP:7WNqkOJWmo1HpM0MkTUmuP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2976	explorer.exe
2536	spoolsv.exe
1664	svchost.exe
2484	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1568	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe
1568	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe
2976	explorer.exe
2976	explorer.exe
2536	spoolsv.exe
2536	spoolsv.exe
1664	svchost.exe
1664	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1568	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
1664	svchost.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe
2976	explorer.exe
1664	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2976	explorer.exe
1664	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1568	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe
1568	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe
2976	explorer.exe
2976	explorer.exe
2536	spoolsv.exe
2536	spoolsv.exe
1664	svchost.exe
1664	svchost.exe
2484	spoolsv.exe
2484	spoolsv.exe
2976	explorer.exe
2976	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2976	1568	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe	28
PID 1568 wrote to memory of 2976	1568	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe	28
PID 1568 wrote to memory of 2976	1568	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe	28
PID 1568 wrote to memory of 2976	1568	49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe	28
PID 2976 wrote to memory of 2536	2976	explorer.exe	29
PID 2976 wrote to memory of 2536	2976	explorer.exe	29
PID 2976 wrote to memory of 2536	2976	explorer.exe	29
PID 2976 wrote to memory of 2536	2976	explorer.exe	29
PID 2536 wrote to memory of 1664	2536	spoolsv.exe	30
PID 2536 wrote to memory of 1664	2536	spoolsv.exe	30
PID 2536 wrote to memory of 1664	2536	spoolsv.exe	30
PID 2536 wrote to memory of 1664	2536	spoolsv.exe	30
PID 1664 wrote to memory of 2484	1664	svchost.exe	31
PID 1664 wrote to memory of 2484	1664	svchost.exe	31
PID 1664 wrote to memory of 2484	1664	svchost.exe	31
PID 1664 wrote to memory of 2484	1664	svchost.exe	31
PID 1664 wrote to memory of 1364	1664	svchost.exe	32
PID 1664 wrote to memory of 1364	1664	svchost.exe	32
PID 1664 wrote to memory of 1364	1664	svchost.exe	32
PID 1664 wrote to memory of 1364	1664	svchost.exe	32
PID 1664 wrote to memory of 1968	1664	svchost.exe	36
PID 1664 wrote to memory of 1968	1664	svchost.exe	36
PID 1664 wrote to memory of 1968	1664	svchost.exe	36
PID 1664 wrote to memory of 1968	1664	svchost.exe	36
PID 1664 wrote to memory of 1888	1664	svchost.exe	38
PID 1664 wrote to memory of 1888	1664	svchost.exe	38
PID 1664 wrote to memory of 1888	1664	svchost.exe	38
PID 1664 wrote to memory of 1888	1664	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe
"C:\Users\Admin\AppData\Local\Temp\49c43f4b6b46642ef80ea0720fd4aa272ab33749bfc7b8e7449852fd3753afc6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2976
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
    - - C:\Windows\SysWOW64\at.exe
        
        at 11:51 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1364
    - - C:\Windows\SysWOW64\at.exe
        
        at 11:52 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1968
    - - C:\Windows\SysWOW64\at.exe
        
        at 11:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
2cf15121a4470e1992456fe675167ce1

SHA1
4b6633769d2609094655673edd3118b0b67ae82d

SHA256
1203a09949f11e775f6a0fe12dcca97a501cb6ad20f5b05044c76f33e8fe2e42

SHA512
604d8e70185c2e22a68a90f8e4eb80a8e9ff07da6dcace6cfbb99538396f6723635603d6fce620ccd0cdb97ae1cdb96f983dbefd2562dae44f0a2afdfb3275e3

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
553a9af19b154630254c4bdd793e42d4

SHA1
44eefca9ce6b6445801f009fd0b94340a37c76d0

SHA256
32cf3343aa0a0b5ada715c3c7b88bbd04aa7850071fa1fe3580cb132a2739d80

SHA512
f0bc09d6c6afbf170d1e686e221b808689d54e282eb26aa17852cd2172247d00de8d085fdbb4ba169ab69498289e932a6b4faa3f15288c19805c9194e33ae694

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
eec7cbf11cadcfe993e45039e69d1e2a

SHA1
f14dbe02821e15160d11ca1d042f2c7db0c87acd

SHA256
671373e8b63a6ab65af83531fe95003e4336d6faa75b951695914d0e2aab15e4

SHA512
82b868e39460ae73ec64ef687f0008b688bbde58c15219fafd55c741149a6ee08bd32687fcf78b7e38d2b7cd0e393b661e32e500f374df976c5ed3933fcb4dcf

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
702b2f127c971f03cf541e8a43482062

SHA1
4f36b5f1070a588fe3cee489e9530bd5c61c8493

SHA256
e498ff6bb84a3c05224d8372c54be3f0f6ea5a23f40355f241dbddb1dbf948ab

SHA512
e343c868916b46ee8935847a516aff405ce659db652d1bac3d9c673f1bd91ffd06ab0b664752cfa081650a77510363e6ac565d7d258871c7b3ddf1a2187a0c40

Download Submit
memory/1568-59-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1568-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1568-16-0x0000000003250000-0x0000000003281000-memory.dmp

Filesize
196KB

Download
memory/1568-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1568-77-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1568-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1568-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1568-53-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1568-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1568-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1664-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1664-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1664-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1664-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2484-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2484-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2536-51-0x00000000025C0000-0x00000000025F1000-memory.dmp

Filesize
196KB

Download
memory/2536-50-0x00000000025C0000-0x00000000025F1000-memory.dmp

Filesize
196KB

Download
memory/2536-39-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2536-35-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2976-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2976-66-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2976-34-0x00000000003C0000-0x00000000003F1000-memory.dmp

Filesize
196KB

Download
memory/2976-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2976-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2976-89-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download