Analysis
-
max time kernel
148s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 04:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe
-
Size
207KB
-
MD5
7ac3da031ee34aed0ddd7f8d7978653f
-
SHA1
83532aa44302ebcf5ed1b07542d2e1ec8a9abaa2
-
SHA256
df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5
-
SHA512
2ce7dd5aedb1d17ac137759f0a31083c5de1177b7418af2822b70de6e90a76754c3578efad32d0b17a306e6cb341bc92ade13eaf6b73105e371abc7ed56ef54b
-
SSDEEP
3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLE:5vEN2U+T6i5LirrllHy4HUcMQY6KE
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 2932 explorer.exe 2520 spoolsv.exe 2704 svchost.exe 2464 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 3008 df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe 3008 df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe 2932 explorer.exe 2932 explorer.exe 2520 spoolsv.exe 2520 spoolsv.exe 2704 svchost.exe 2704 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe 2932 explorer.exe 2932 explorer.exe 2932 explorer.exe 2932 explorer.exe 2932 explorer.exe 2704 svchost.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe 2932 explorer.exe 2704 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2932 explorer.exe 2704 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3008 df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe 3008 df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe 2932 explorer.exe 2932 explorer.exe 2520 spoolsv.exe 2520 spoolsv.exe 2704 svchost.exe 2704 svchost.exe 2464 spoolsv.exe 2464 spoolsv.exe 2932 explorer.exe 2932 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2932 3008 df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe 28 PID 3008 wrote to memory of 2932 3008 df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe 28 PID 3008 wrote to memory of 2932 3008 df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe 28 PID 3008 wrote to memory of 2932 3008 df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe 28 PID 2932 wrote to memory of 2520 2932 explorer.exe 29 PID 2932 wrote to memory of 2520 2932 explorer.exe 29 PID 2932 wrote to memory of 2520 2932 explorer.exe 29 PID 2932 wrote to memory of 2520 2932 explorer.exe 29 PID 2520 wrote to memory of 2704 2520 spoolsv.exe 30 PID 2520 wrote to memory of 2704 2520 spoolsv.exe 30 PID 2520 wrote to memory of 2704 2520 spoolsv.exe 30 PID 2520 wrote to memory of 2704 2520 spoolsv.exe 30 PID 2704 wrote to memory of 2464 2704 svchost.exe 31 PID 2704 wrote to memory of 2464 2704 svchost.exe 31 PID 2704 wrote to memory of 2464 2704 svchost.exe 31 PID 2704 wrote to memory of 2464 2704 svchost.exe 31 PID 2704 wrote to memory of 2876 2704 svchost.exe 32 PID 2704 wrote to memory of 2876 2704 svchost.exe 32 PID 2704 wrote to memory of 2876 2704 svchost.exe 32 PID 2704 wrote to memory of 2876 2704 svchost.exe 32 PID 2704 wrote to memory of 1932 2704 svchost.exe 36 PID 2704 wrote to memory of 1932 2704 svchost.exe 36 PID 2704 wrote to memory of 1932 2704 svchost.exe 36 PID 2704 wrote to memory of 1932 2704 svchost.exe 36 PID 2704 wrote to memory of 2096 2704 svchost.exe 38 PID 2704 wrote to memory of 2096 2704 svchost.exe 38 PID 2704 wrote to memory of 2096 2704 svchost.exe 38 PID 2704 wrote to memory of 2096 2704 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe"C:\Users\Admin\AppData\Local\Temp\df579052fa681d2ed07351035c9ab78ed5dd1beb493c4c27c40a02d775ea72f5.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2464
-
-
C:\Windows\SysWOW64\at.exeat 04:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2876
-
-
C:\Windows\SysWOW64\at.exeat 04:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1932
-
-
C:\Windows\SysWOW64\at.exeat 04:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2096
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD58eb8615222c87e5c4c093aaa8cf089cd
SHA1c7e21a567fc13b77c4d62a1755cd3612fb73f730
SHA256577e452484c4ff0e7cb9aa30a6d224c1b01143c6bc56f699362120d5916152c6
SHA5121c302dd037635dc0ff24ae3f8f3f85d909da41bbab0e81116bd1a09f16d8a4c677603c9fb6971759b038e6f40af15494bd74c1837de64d5778825f2fdf85cca4
-
Filesize
206KB
MD57e3f73160c2ef95c07d69399fbace1d5
SHA12babdc1392d165a2546a75067353244c0c81665a
SHA256b1d24b304eb247af4495098ab3d4e257b984c5441a814bc61d9dcf3850f58636
SHA5126e3422e1282152377221940d768f94f293af4d88f4415d64a8b5113e82880fe4cb7669194bc886503f81c11a703062b8cc9b6ece4b1938b0f25373a32df47a2b
-
Filesize
207KB
MD596f35dc94a3ec350ccc9e7d19683bb7d
SHA1f964c43e857bd5f6fe8f566c1259b2a327a3d126
SHA25691e37222e5fd5cde56da84574d3a385425233e19a32a0d20e0c2b5ade8ea0a8b
SHA5123f8cc785331fcf93f0a2531ee265e4d5a0e039b07bc93557e0e19b5f5ac3676a60c62692de65c715b834047b36acd89289f2f2f2cb28c58aa42c36da9f28243b
-
Filesize
206KB
MD51c40f9524dfe1ae8fbbafb3676b50dee
SHA1e87663c1103d925a87ce58342164788fea9909b2
SHA25636d3835cfed4b9eca5b2aa4b38455bc884ec058703d7dba0fcd32a05eea5ccf3
SHA512cb46ff50dbae5327314252db54f1cb729d901a42f4834bffaa2e4e3fb7f4dff91377a8787e095a218c74ec8c0a34e45bc962dc16cc62614dff495b9e79658063