65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe
Size

66KB
MD5

64e0703fdb2060ad9a9b51a956395a2f
SHA1

fb6fbc8a78f093c28325577d8a2fa59a94d44985
SHA256

65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf
SHA512

0786af8d971904a1942b7cbe055235d899d455e1f1e3950a03b9d0f56fb8f6065667b36a819ebedab128e2ff0dcda6e72b0762351c8b0279d661ce2d857073dc
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiF:IeklMMYJhqezw/pXzH9iF

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2192	explorer.exe
2560	spoolsv.exe
2708	svchost.exe
2620	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
948	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe
948	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe
2192	explorer.exe
2192	explorer.exe
2560	spoolsv.exe
2560	spoolsv.exe
2708	svchost.exe
2708	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
948	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
2192	explorer.exe
2708	svchost.exe
2708	svchost.exe
2708	svchost.exe
2192	explorer.exe
2192	explorer.exe
2708	svchost.exe
2708	svchost.exe
2192	explorer.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2708	svchost.exe
2192	explorer.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2708	svchost.exe
2192	explorer.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2192	explorer.exe
2708	svchost.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2192	explorer.exe
2708	svchost.exe
2192	explorer.exe
2708	svchost.exe
2708	svchost.exe
2192	explorer.exe
2192	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2192	explorer.exe
2708	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
948	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe
948	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe
2192	explorer.exe
2192	explorer.exe
2560	spoolsv.exe
2560	spoolsv.exe
2708	svchost.exe
2708	svchost.exe
2620	spoolsv.exe
2620	spoolsv.exe
2192	explorer.exe
2192	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 2192	948	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe	28
PID 948 wrote to memory of 2192	948	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe	28
PID 948 wrote to memory of 2192	948	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe	28
PID 948 wrote to memory of 2192	948	65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe	28
PID 2192 wrote to memory of 2560	2192	explorer.exe	29
PID 2192 wrote to memory of 2560	2192	explorer.exe	29
PID 2192 wrote to memory of 2560	2192	explorer.exe	29
PID 2192 wrote to memory of 2560	2192	explorer.exe	29
PID 2560 wrote to memory of 2708	2560	spoolsv.exe	30
PID 2560 wrote to memory of 2708	2560	spoolsv.exe	30
PID 2560 wrote to memory of 2708	2560	spoolsv.exe	30
PID 2560 wrote to memory of 2708	2560	spoolsv.exe	30
PID 2708 wrote to memory of 2620	2708	svchost.exe	31
PID 2708 wrote to memory of 2620	2708	svchost.exe	31
PID 2708 wrote to memory of 2620	2708	svchost.exe	31
PID 2708 wrote to memory of 2620	2708	svchost.exe	31
PID 2708 wrote to memory of 2828	2708	svchost.exe	32
PID 2708 wrote to memory of 2828	2708	svchost.exe	32
PID 2708 wrote to memory of 2828	2708	svchost.exe	32
PID 2708 wrote to memory of 2828	2708	svchost.exe	32
PID 2708 wrote to memory of 1444	2708	svchost.exe	36
PID 2708 wrote to memory of 1444	2708	svchost.exe	36
PID 2708 wrote to memory of 1444	2708	svchost.exe	36
PID 2708 wrote to memory of 1444	2708	svchost.exe	36
PID 2708 wrote to memory of 2304	2708	svchost.exe	38
PID 2708 wrote to memory of 2304	2708	svchost.exe	38
PID 2708 wrote to memory of 2304	2708	svchost.exe	38
PID 2708 wrote to memory of 2304	2708	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe
"C:\Users\Admin\AppData\Local\Temp\65b938e7fa958188eb05272c548b5849f71826c882eacbf334e476324562cbaf.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2192
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2828
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1444
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
4043bf72cf4c98373091fad7a57f6310

SHA1
021e2c7114534b88aae5a0e0ac5650d8e2355ff7

SHA256
8fd94892fba185bd5359c75dbd6d5fb03166c20a74f69abff29c43af4b79d4e6

SHA512
c55b88d25a68fe87f80b875a525281349f40cea1529fcd1e53d6f6a4f8a3b9944dced9b104c536108af9e7c75cbe3afe14738323454449f5f39b2e74ab277edb

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
d5f39f59c6c667a1c3e2e29cf3d56a2c

SHA1
7a5f447702a920c1b22034332148c85f3437681e

SHA256
5a02e9a2658af750d7c4bd01259bafcf6f6b57690e99e12d1421620088faf2d8

SHA512
5e861630df1d9ffc1564678b8047c4527972935aeae53043e4530d6be92b5ccb2c296b8692e155f85db6171514ebd0d41031699c683061d0e149a6e1d92d3d6c

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
49a4773c8e9b4828a4aea4e58301c18a

SHA1
ce4037f8573cd82463d021338378ec4210b9dd8d

SHA256
9d8603195714e5ac718c28256642de72d852d45cecc2622d96730fe44a7d6e4f

SHA512
5a969981991346a94def9f761ef5d178c6a525a2740c98656c9248d4ac2f25451edba4b03e405a896b267dd2f16645e01a144114d06000284e2a5ef8c1a1b8d5

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
caf1bb3969512596be418e47436a3d6f

SHA1
f72935eac404f12ed47720c70a963b74385d5c18

SHA256
2c6b5dbe5f3fe55fe38125f1e2adcf0ae4b4d1d35a9e631d0fbd72e9435677c1

SHA512
8fa3916d79bcb55a308659df77337b014d5475141c8b87237221b63414a6656b025e253b74c5f0c502852501e1a156d7a0ee767b5f7dfaed9906261a2c2b700a

Download Submit
memory/948-12-0x0000000003220000-0x0000000003251000-memory.dmp

Filesize
196KB

Download
memory/948-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/948-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/948-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/948-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/948-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/948-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/948-80-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/948-55-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/948-52-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2192-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2192-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2192-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2192-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2192-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2192-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2192-34-0x0000000002C50000-0x0000000002C81000-memory.dmp

Filesize
196KB

Download
memory/2560-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2560-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2560-53-0x00000000027A0000-0x00000000027D1000-memory.dmp

Filesize
196KB

Download
memory/2560-51-0x00000000027A0000-0x00000000027D1000-memory.dmp

Filesize
196KB

Download
memory/2560-40-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2620-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2620-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2708-57-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2708-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2708-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2708-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download