89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe
Size

66KB
MD5

6e7bf8b37b4750dda7205f7837cdf88a
SHA1

3f185a019679c7ac429560d905185666d21a0cbb
SHA256

89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b
SHA512

7ddeb2a03180743f57fa35af70456b0905e2977542a6f7a63747f181c7e371e9c0ccc4f3dce435fd54595097f52bcad2919f752bbf8e14cfd5a6e067e1197116
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXim:IeklMMYJhqezw/pXzH9im

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2176	explorer.exe
2708	spoolsv.exe
2672	svchost.exe
2560	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2932	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe
2932	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe
2176	explorer.exe
2176	explorer.exe
2708	spoolsv.exe
2708	spoolsv.exe
2672	svchost.exe
2672	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2932	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe
2176	explorer.exe
2176	explorer.exe
2176	explorer.exe
2672	svchost.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe
2176	explorer.exe
2672	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2176	explorer.exe
2672	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2932	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe
2932	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe
2176	explorer.exe
2176	explorer.exe
2708	spoolsv.exe
2708	spoolsv.exe
2672	svchost.exe
2672	svchost.exe
2560	spoolsv.exe
2560	spoolsv.exe
2176	explorer.exe
2176	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2176	2932	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe	29
PID 2932 wrote to memory of 2176	2932	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe	29
PID 2932 wrote to memory of 2176	2932	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe	29
PID 2932 wrote to memory of 2176	2932	89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe	29
PID 2176 wrote to memory of 2708	2176	explorer.exe	30
PID 2176 wrote to memory of 2708	2176	explorer.exe	30
PID 2176 wrote to memory of 2708	2176	explorer.exe	30
PID 2176 wrote to memory of 2708	2176	explorer.exe	30
PID 2708 wrote to memory of 2672	2708	spoolsv.exe	31
PID 2708 wrote to memory of 2672	2708	spoolsv.exe	31
PID 2708 wrote to memory of 2672	2708	spoolsv.exe	31
PID 2708 wrote to memory of 2672	2708	spoolsv.exe	31
PID 2672 wrote to memory of 2560	2672	svchost.exe	32
PID 2672 wrote to memory of 2560	2672	svchost.exe	32
PID 2672 wrote to memory of 2560	2672	svchost.exe	32
PID 2672 wrote to memory of 2560	2672	svchost.exe	32
PID 2672 wrote to memory of 2556	2672	svchost.exe	33
PID 2672 wrote to memory of 2556	2672	svchost.exe	33
PID 2672 wrote to memory of 2556	2672	svchost.exe	33
PID 2672 wrote to memory of 2556	2672	svchost.exe	33
PID 2672 wrote to memory of 1844	2672	svchost.exe	37
PID 2672 wrote to memory of 1844	2672	svchost.exe	37
PID 2672 wrote to memory of 1844	2672	svchost.exe	37
PID 2672 wrote to memory of 1844	2672	svchost.exe	37
PID 2672 wrote to memory of 600	2672	svchost.exe	39
PID 2672 wrote to memory of 600	2672	svchost.exe	39
PID 2672 wrote to memory of 600	2672	svchost.exe	39
PID 2672 wrote to memory of 600	2672	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe
"C:\Users\Admin\AppData\Local\Temp\89b96fea16ac1a25264e98d7a7596525897061c73350359c7f95fa4bb799899b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2556
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1844
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
488a7b26ee633c1640863ea3fdc5c143

SHA1
54fd039b1934d291830cf253ec08ceb93f5bf6b1

SHA256
a2e088a2f09888f96db600e98383a5d642ba34686061a8b6fced4cbbee5c3c31

SHA512
44906c05f3963be03759455f42cb986e9e49cfadcfc942bbb712f4cccd14800c27239c42d3fa26b1d2bbd3badc07133447d08bea70c1fa4f10f0f60e128143b2

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
66KB

MD5
3f2f3d7a822c65d251b25683b1beb0de

SHA1
4d2c14d0284cda3f13864f6e19dcfbfcdec19104

SHA256
8242a0bacc84ab9d39807cdc5e3011d67f5c4d80770b5d797e0f15a2fa1ff1be

SHA512
cad8713a76bbe1bbd87ed59e8bd5bf230030b14f8ae53b819aa85d4da01dfd1f2ce0159b8952954c57547f5baa463621154eda26a3311cd5ac232661f2c5adb6

Download Submit
C:\Windows\system\svchost.exe

Filesize
66KB

MD5
3736ed66f7f8a6ef40e1e2d223fc9e84

SHA1
c99e0c6676f53cf2747cbb0f1904e18df90af4a2

SHA256
3741cbea8c21fa3e1dcb79b73c7af6e73e3653782e03bc69e8c438e6cf72f4ca

SHA512
0ac50a7381584cc7c8687e46809a227d0fe36a38339243446571858adbf4cd1e3bfcd875036771df9d30723cac2f1d9dffceb22d0382e7d28e4956d1cf093eaa

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
16bd73554c655c26557c5ed07c727c54

SHA1
9cbe97a3182b0d11b275a1b79a1e4fe366702ce6

SHA256
9f59d3ba31c6e859ab7630a7071bcbaf5a4b07259a7f7453d301958d25b78c12

SHA512
3b94c9c158915d72536a92040493f3fa30cf3268ba7b881aec89d0a4efbfaa02d72ceabc0ed22303c7e4f8c56445474c2034a05dbd2054b9530d13e2686f3b21

Download Submit
memory/2176-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2176-36-0x0000000002C60000-0x0000000002C91000-memory.dmp

Filesize
196KB

Download
memory/2176-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2176-37-0x0000000002C60000-0x0000000002C91000-memory.dmp

Filesize
196KB

Download
memory/2176-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2176-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2176-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2176-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2560-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2560-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2672-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2672-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2672-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2672-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2708-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2708-44-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2708-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2708-54-0x0000000002760000-0x0000000002791000-memory.dmp

Filesize
196KB

Download
memory/2932-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2932-78-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2932-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2932-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2932-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2932-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2932-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2932-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2932-17-0x0000000002B40000-0x0000000002B71000-memory.dmp

Filesize
196KB

Download