64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe
Size

65KB
MD5

67aa81e004ee80c67bbeaaffc1cb4a6e
SHA1

25e0af325613b64a45b135c6d2e045cd635a6665
SHA256

64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787
SHA512

6c72a84851e46dd333f3eb7613f573ee6464854ab6a1b39b1d5cf9f25a272bbc0743c6af6a4ce362cfc3b100d79ff8bdd0aec44acfad27e9a3aa26cae726c441
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OufccccccccccccccccccY:7WNqkOJWmo1HpM0MkTUmufcccccccccz

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4112	explorer.exe
4532	spoolsv.exe
4852	svchost.exe
540	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1620	64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe
1620	64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe
4112	explorer.exe
4112	explorer.exe
4852	svchost.exe
4852	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4112	explorer.exe
4852	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1620	64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe
1620	64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe
4112	explorer.exe
4112	explorer.exe
4532	spoolsv.exe
4532	spoolsv.exe
4852	svchost.exe
4852	svchost.exe
540	spoolsv.exe
540	spoolsv.exe
4112	explorer.exe
4112	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 4112	1620	64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe	80
PID 1620 wrote to memory of 4112	1620	64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe	80
PID 1620 wrote to memory of 4112	1620	64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe	80
PID 4112 wrote to memory of 4532	4112	explorer.exe	81
PID 4112 wrote to memory of 4532	4112	explorer.exe	81
PID 4112 wrote to memory of 4532	4112	explorer.exe	81
PID 4532 wrote to memory of 4852	4532	spoolsv.exe	83
PID 4532 wrote to memory of 4852	4532	spoolsv.exe	83
PID 4532 wrote to memory of 4852	4532	spoolsv.exe	83
PID 4852 wrote to memory of 540	4852	svchost.exe	85
PID 4852 wrote to memory of 540	4852	svchost.exe	85
PID 4852 wrote to memory of 540	4852	svchost.exe	85
PID 4852 wrote to memory of 5060	4852	svchost.exe	86
PID 4852 wrote to memory of 5060	4852	svchost.exe	86
PID 4852 wrote to memory of 5060	4852	svchost.exe	86
PID 4852 wrote to memory of 612	4852	svchost.exe	91
PID 4852 wrote to memory of 612	4852	svchost.exe	91
PID 4852 wrote to memory of 612	4852	svchost.exe	91
PID 4852 wrote to memory of 3168	4852	svchost.exe	93
PID 4852 wrote to memory of 3168	4852	svchost.exe	93
PID 4852 wrote to memory of 3168	4852	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe
"C:\Users\Admin\AppData\Local\Temp\64863a94905acb539de29bbefa075940d2d7da96224392181081c3f495c15787.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4112
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:5060
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:612
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
0042aaf9f8a1002a6344be9df259ca66

SHA1
f3abeec8111344606880851eb9369929a19a19cf

SHA256
b83aacefe7af12efdc341828b4db7e5c407c8c89e75c3963d30ab674ef0367ac

SHA512
7e16fd20ffc4a55ecfe1d35018d14f0fcff5a86866e993d9be17c71959cd4ca68518fc672b1409d1cb6f6e328de7bef5c5228f6eda2a41964baa4ee06a7075f2

Download Submit
C:\Windows\System\explorer.exe

Filesize
65KB

MD5
a176e84859afc6029f515281e1aaee87

SHA1
94f68a620ea18c5483e6e13b3f6f3c948aa0e1ff

SHA256
fd0a299527c80d6a87e27da3549d805297290058e8fad87216065b0b9f9ed6a9

SHA512
85027f855514075b35c170d5b26abd4df4a04e946514dceba210cbce058542bea7dcd9f13ad68abf76675a09bde7026f0735d5a7a1fc608994f5db29178b8103

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
65KB

MD5
1c633a12b8474de7c788f8b91d85597b

SHA1
460b8588358f53d67f7f9b97907947f4ea92c931

SHA256
f70a2d20bda122dbe59913ad360bb062687573836085e218fea237f17055742d

SHA512
5389612b0f3fd93d2d3a9eee70362c0e07ec17111f42a482099799c57ca37157af57e429f5b60a02cc1d237a9ca1fe786aa8dfb1b84427a86bf0557b2c1f2202

Download Submit
C:\Windows\System\svchost.exe

Filesize
65KB

MD5
0cb2907530745633a670b07a2f6b0697

SHA1
86105a213fe02427cec90d4828fb75af3aa49ade

SHA256
2f9d3baf2122931908bad26256b898283b5b3a97eedf19a9ebb09f7678631728

SHA512
f74ffadd0492cff75aecde5fa8e1b85bc4ef4b8213356de883e2cbc31da13b7eddf1b8b8850dfd201615238ddbe739dc5d0385ebde41f981c4ceea46a748e26c

Download Submit
memory/540-46-0x0000000075340000-0x000000007549D000-memory.dmp

Filesize
1.4MB

Download
memory/540-52-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1620-5-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1620-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/1620-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1620-2-0x0000000075340000-0x000000007549D000-memory.dmp

Filesize
1.4MB

Download
memory/1620-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1620-60-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1620-58-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/1620-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4112-15-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4112-13-0x0000000075340000-0x000000007549D000-memory.dmp

Filesize
1.4MB

Download
memory/4112-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4112-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4112-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4532-26-0x0000000075340000-0x000000007549D000-memory.dmp

Filesize
1.4MB

Download
memory/4532-31-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4532-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4532-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4852-44-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4852-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4852-64-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4852-38-0x0000000075340000-0x000000007549D000-memory.dmp

Filesize
1.4MB

Download
memory/4852-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download