04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
Size

66KB
MD5

3e2428db2164bb359d7c6f4d6245bd85
SHA1

5f0f3bfdd00b08e98011597e179b9f58fd510b81
SHA256

04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d
SHA512

0a88545e7755eac6be3ef832b2bd6f76c12e9a97e01bd57729618fb0ce519c9d163b1c277d8809dbfc4dbb46dde433b61dcc0992c5a887e77539a18adbe73c13
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXih:IeklMMYJhqezw/pXzH9ih

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
940	explorer.exe
2712	spoolsv.exe
1548	svchost.exe
2520	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2724	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
2724	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
940	explorer.exe
940	explorer.exe
2712	spoolsv.exe
2712	spoolsv.exe
1548	svchost.exe
1548	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2724	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
1548	svchost.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe
940	explorer.exe
1548	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
940	explorer.exe
1548	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2724	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
2724	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
940	explorer.exe
940	explorer.exe
2712	spoolsv.exe
2712	spoolsv.exe
1548	svchost.exe
1548	svchost.exe
2520	spoolsv.exe
2520	spoolsv.exe
940	explorer.exe
940	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 940	2724	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe	28
PID 2724 wrote to memory of 940	2724	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe	28
PID 2724 wrote to memory of 940	2724	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe	28
PID 2724 wrote to memory of 940	2724	04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe	28
PID 940 wrote to memory of 2712	940	explorer.exe	29
PID 940 wrote to memory of 2712	940	explorer.exe	29
PID 940 wrote to memory of 2712	940	explorer.exe	29
PID 940 wrote to memory of 2712	940	explorer.exe	29
PID 2712 wrote to memory of 1548	2712	spoolsv.exe	30
PID 2712 wrote to memory of 1548	2712	spoolsv.exe	30
PID 2712 wrote to memory of 1548	2712	spoolsv.exe	30
PID 2712 wrote to memory of 1548	2712	spoolsv.exe	30
PID 1548 wrote to memory of 2520	1548	svchost.exe	31
PID 1548 wrote to memory of 2520	1548	svchost.exe	31
PID 1548 wrote to memory of 2520	1548	svchost.exe	31
PID 1548 wrote to memory of 2520	1548	svchost.exe	31
PID 1548 wrote to memory of 2452	1548	svchost.exe	32
PID 1548 wrote to memory of 2452	1548	svchost.exe	32
PID 1548 wrote to memory of 2452	1548	svchost.exe	32
PID 1548 wrote to memory of 2452	1548	svchost.exe	32
PID 1548 wrote to memory of 2368	1548	svchost.exe	36
PID 1548 wrote to memory of 2368	1548	svchost.exe	36
PID 1548 wrote to memory of 2368	1548	svchost.exe	36
PID 1548 wrote to memory of 2368	1548	svchost.exe	36
PID 1548 wrote to memory of 2292	1548	svchost.exe	38
PID 1548 wrote to memory of 2292	1548	svchost.exe	38
PID 1548 wrote to memory of 2292	1548	svchost.exe	38
PID 1548 wrote to memory of 2292	1548	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
"C:\Users\Admin\AppData\Local\Temp\04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:940
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2452
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2368
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
567d680abac687b7780b738681ae27d1

SHA1
47518e309a144f7c1bcdbfb66c978b2990710706

SHA256
4f733fcd024991f416df3d9af48cde7252a2a3b075c6cf06022db2d07d0bd9dd

SHA512
05bf17adf5e44b49c0c4ff393adbdb52bf41cdad302b8203fa82fe9fd29e6fdf5a3654609fcd3366f1e18b2b3cb49508cdc34d26ba0eac0333693482d956ed17

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
2961a4013a53f09d80a584cbc428f349

SHA1
e29c69b22cfaebb823f8f3252606a9a8b2bbb0d4

SHA256
2cc77969890d52918fa2a362a21b952280ff217f519c074ed22d3d42d4f6cdcc

SHA512
5a4e0267349d44b8e20d819043b3b15534e662dd37144ab5d22de0535684f9cef755772a12224c62e971bd8b4ae72f105ef7a40670f03f53d9261a2b860c75cf

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
49ab39548e7eaa686c4eac1228f87216

SHA1
82036e34234e8789acabb3d3f6c649c05d975bc3

SHA256
dca402af341c60d8fc451b6f45b7fb5f07db3b4c7369c8f0e8b9689a02de1361

SHA512
91d0a9a861276bcc049bc702cd6e02f23c0cbbf971b8c02553d2d5b975536741959230f5cb3736e07ebdd377cf486bf10c5eecd9b12c99addc7f01290e304732

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
b60432ccc8e2acd60993609f898b9902

SHA1
abd43678e33f98c6c5f457d268173b21efdfb17f

SHA256
a27b8aa8066717c51fd65229b7e0e77ea598c4466f7faf202c820648be7251c6

SHA512
db02783c16ac1a44276dae03d92cb2c7352febde94b73c928623d7da1645ffc742f8a049d30b3c244ed6ec685471b939b24b9223234f6b83f485fe57ade2a5af

Download Submit
memory/940-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/940-91-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/940-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/940-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/940-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/940-35-0x0000000002B40000-0x0000000002B71000-memory.dmp

Filesize
196KB

Download
memory/940-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1548-57-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1548-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1548-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1548-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2520-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2520-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2712-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2712-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2712-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2712-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2712-55-0x0000000002470000-0x00000000024A1000-memory.dmp

Filesize
196KB

Download
memory/2724-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2724-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2724-54-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2724-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2724-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2724-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2724-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2724-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2724-16-0x00000000027F0000-0x0000000002821000-memory.dmp

Filesize
196KB

Download
memory/2724-17-0x00000000027F0000-0x0000000002821000-memory.dmp

Filesize
196KB

Download