000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe
Size

65KB
MD5

071d8db2ee387cb1fa99f7ec9df9c80d
SHA1

5da71a244435be389d1bd08703587cacd75a21e7
SHA256

000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06
SHA512

8df999adb552ea8f68126e2069be65868bf07ae95aa9a1c2daeda57ab0155dcde0eb53610e178e42b49f13d028c2adb5206abc2cea13b3bbc0384c4399a439fe
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuF:7WNqkOJWmo1HpM0MkTUmuF

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2512	explorer.exe
4564	spoolsv.exe
3712	svchost.exe
904	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4920	000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe
4920	000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe
2512	explorer.exe
2512	explorer.exe
2512	explorer.exe
2512	explorer.exe
2512	explorer.exe
2512	explorer.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
3712	svchost.exe
3712	svchost.exe
2512	explorer.exe
2512	explorer.exe
3712	svchost.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe
3712	svchost.exe
2512	explorer.exe
2512	explorer.exe
3712	svchost.exe
2512	explorer.exe
3712	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2512	explorer.exe
3712	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4920	000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe
4920	000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe
2512	explorer.exe
2512	explorer.exe
4564	spoolsv.exe
4564	spoolsv.exe
3712	svchost.exe
3712	svchost.exe
904	spoolsv.exe
904	spoolsv.exe
2512	explorer.exe
2512	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2512	4920	000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe	81
PID 4920 wrote to memory of 2512	4920	000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe	81
PID 4920 wrote to memory of 2512	4920	000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe	81
PID 2512 wrote to memory of 4564	2512	explorer.exe	82
PID 2512 wrote to memory of 4564	2512	explorer.exe	82
PID 2512 wrote to memory of 4564	2512	explorer.exe	82
PID 4564 wrote to memory of 3712	4564	spoolsv.exe	83
PID 4564 wrote to memory of 3712	4564	spoolsv.exe	83
PID 4564 wrote to memory of 3712	4564	spoolsv.exe	83
PID 3712 wrote to memory of 904	3712	svchost.exe	84
PID 3712 wrote to memory of 904	3712	svchost.exe	84
PID 3712 wrote to memory of 904	3712	svchost.exe	84
PID 3712 wrote to memory of 496	3712	svchost.exe	85
PID 3712 wrote to memory of 496	3712	svchost.exe	85
PID 3712 wrote to memory of 496	3712	svchost.exe	85
PID 3712 wrote to memory of 1668	3712	svchost.exe	95
PID 3712 wrote to memory of 1668	3712	svchost.exe	95
PID 3712 wrote to memory of 1668	3712	svchost.exe	95
PID 3712 wrote to memory of 4200	3712	svchost.exe	97
PID 3712 wrote to memory of 4200	3712	svchost.exe	97
PID 3712 wrote to memory of 4200	3712	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe
"C:\Users\Admin\AppData\Local\Temp\000f7795f332cd5df11b6f17d54c7b210839cd045b72c765615ece487416ee06.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2512
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:496
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1668
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
5d10a93aa57c94d53a558ddecf67f8a4

SHA1
0c84bf7888f8962dd964846b74cf72e182cf3de9

SHA256
8de624eb4102bd155330b11db664c243391053e45b9ada03c4c88304de4e67f0

SHA512
e059a4a8eae830107817b76a6515445fddf67a74e4300b85f5cf6d8509b739859039d7786f55318c5a12ab1abc0558e1654e448e27096d45d4591876c231375f

Download Submit
C:\Windows\System\explorer.exe

Filesize
65KB

MD5
190410cf03586665c8fc24175a740078

SHA1
4e5752f41da54e2035216527361fd1d7e7847b37

SHA256
e24bde35760128d02de887624e7f93e6252945c1fa6b4093f7d2b6a724597066

SHA512
1f93e9c402dff26a28c6e79983e60aa9ff8e34d94ec3a522fd613a0d5123966fb56b0dbf443c8dd4bced29248b2ea452da4d619ca13b7cca9da5ccf43bc01ff3

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
65KB

MD5
a061524f1f948c57391923aee7bb7250

SHA1
328ba21d8efd6a14c0c77b443b167c04feaaff1c

SHA256
59a590339a9d5ed2a6873d4402ef68ce750f983bdb78b865f35d1a6b0f6752d6

SHA512
abcb0431364b0c7ad99d0eea2df46dffa59130dad526d30bb1b99c8a92d5a7de5f3439d8fc32a8ea244f1dc132e802c1db7953848230743a5e6e42475da11e68

Download Submit
C:\Windows\System\svchost.exe

Filesize
65KB

MD5
c82cc0e94a128ae3901acf1c1e260432

SHA1
a9a9b856589e64f88b2d5ca7a6cc1a39f65d5300

SHA256
eb49c0947905a6b28c82120d51fdeb9cf2387ae0c1a618590574bad3fa2a70f6

SHA512
bb5460870908b612caae4e51701ba5b62bfa25edf277a1408623e384dc2d43ba9a64c3909aa8e3f4d9e76e1e3c0572c96101a1f677a90189141fe3542865d039

Download Submit
memory/904-52-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/904-46-0x0000000074CF0000-0x0000000074E4D000-memory.dmp

Filesize
1.4MB

Download
memory/904-45-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-14-0x0000000074CF0000-0x0000000074E4D000-memory.dmp

Filesize
1.4MB

Download
memory/3712-37-0x0000000074CF0000-0x0000000074E4D000-memory.dmp

Filesize
1.4MB

Download
memory/3712-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3712-39-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4564-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4564-30-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4564-26-0x0000000074CF0000-0x0000000074E4D000-memory.dmp

Filesize
1.4MB

Download
memory/4564-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4920-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4920-44-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/4920-2-0x0000000074CF0000-0x0000000074E4D000-memory.dmp

Filesize
1.4MB

Download
memory/4920-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4920-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/4920-59-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4920-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4920-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download