02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
Size

216KB
MD5

102b222ef289a3791b9bd61bb46483f1
SHA1

baf2de4b3a34e58740969ec40766090543a7c404
SHA256

02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db
SHA512

ab2defc6cf100b482ed60e709aa124b6360643f700a03807754121dcb7e307c43aff814ed545489dae45153f02809da9fb481f6179bcb755a9eedd0102a527e5
SSDEEP

3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9iT:7vEN2U+T6i5LirrllHy4HUcMQY6C9iT

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2468	explorer.exe
2604	spoolsv.exe
2908	svchost.exe
2544	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
3036	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
3036	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
2468	explorer.exe
2468	explorer.exe
2604	spoolsv.exe
2604	spoolsv.exe
2908	svchost.exe
2908	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3036	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2908	svchost.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe
2468	explorer.exe
2908	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2468	explorer.exe
2908	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3036	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
3036	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
2468	explorer.exe
2468	explorer.exe
2604	spoolsv.exe
2604	spoolsv.exe
2908	svchost.exe
2908	svchost.exe
2544	spoolsv.exe
2544	spoolsv.exe
2468	explorer.exe
2468	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2468	3036	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe	28
PID 3036 wrote to memory of 2468	3036	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe	28
PID 3036 wrote to memory of 2468	3036	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe	28
PID 3036 wrote to memory of 2468	3036	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe	28
PID 2468 wrote to memory of 2604	2468	explorer.exe	29
PID 2468 wrote to memory of 2604	2468	explorer.exe	29
PID 2468 wrote to memory of 2604	2468	explorer.exe	29
PID 2468 wrote to memory of 2604	2468	explorer.exe	29
PID 2604 wrote to memory of 2908	2604	spoolsv.exe	30
PID 2604 wrote to memory of 2908	2604	spoolsv.exe	30
PID 2604 wrote to memory of 2908	2604	spoolsv.exe	30
PID 2604 wrote to memory of 2908	2604	spoolsv.exe	30
PID 2908 wrote to memory of 2544	2908	svchost.exe	31
PID 2908 wrote to memory of 2544	2908	svchost.exe	31
PID 2908 wrote to memory of 2544	2908	svchost.exe	31
PID 2908 wrote to memory of 2544	2908	svchost.exe	31
PID 2908 wrote to memory of 2500	2908	svchost.exe	32
PID 2908 wrote to memory of 2500	2908	svchost.exe	32
PID 2908 wrote to memory of 2500	2908	svchost.exe	32
PID 2908 wrote to memory of 2500	2908	svchost.exe	32
PID 2908 wrote to memory of 1876	2908	svchost.exe	36
PID 2908 wrote to memory of 1876	2908	svchost.exe	36
PID 2908 wrote to memory of 1876	2908	svchost.exe	36
PID 2908 wrote to memory of 1876	2908	svchost.exe	36
PID 2908 wrote to memory of 2472	2908	svchost.exe	38
PID 2908 wrote to memory of 2472	2908	svchost.exe	38
PID 2908 wrote to memory of 2472	2908	svchost.exe	38
PID 2908 wrote to memory of 2472	2908	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
"C:\Users\Admin\AppData\Local\Temp\02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2468
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2500
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1876
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
216KB

MD5
6737f1074e3c2befed22a7a69c8bb904

SHA1
e4efe2f3e4713471db408bfe1f031136e8c81bcb

SHA256
663c8d61ebeb8bb06e320da34202a8efb07f3bf0bdbccbd65f17d0fd3dbbf2c9

SHA512
c23d3c62f985a028b796cac8da3e2353a67702a05e3d3a1bcdfc6c789b6cf79c023e05e10326b085577e370a3c516de8f379eda5acc758bb7fee0e071d1e8b4b

Download Submit
C:\Windows\system\explorer.exe

Filesize
216KB

MD5
ae9cde044ae30106cd55562b268e5edc

SHA1
8dd933fbaccbdc23116cbf2dc4074abe89776de2

SHA256
82ac3a9a84f6a74c0b71e02a677115f491f912852ab5bf0340d5b728fd527c92

SHA512
6dbfbf9f4e0e2c245d1b4b43a64ed827f4a03b862c80b8cb7b6aeb7e8bd1ab7ada46900aa332984fccf23da9deb76905baef1f096b3aed36cd8c911696d207d3

Download Submit
\Windows\system\spoolsv.exe

Filesize
216KB

MD5
df50180ce94ce4dca2c205011e8d17dd

SHA1
0abef50211751e96e910ed01a3f4fee02bbcf6f7

SHA256
dda2a138bcc33ca24b545170d3b1eb7eb122b1591c2f88b7354c13a6ccda1fa9

SHA512
c9793315ad770d1f029135a42e8f5301c5e504c1081ed66753e04b73ac2ff3ffb6e6990a4511321e3991da1c155e518d3329be4e79eab09cb721453f9ecbebe1

Download Submit
\Windows\system\svchost.exe

Filesize
216KB

MD5
aba84b487cc17963e857aea880d27628

SHA1
1a852da440e581b3df4a8c8d088863fdb00b290b

SHA256
e88eaf9302a46b772d18cadac2b2097f123a94e604b1892f6451beef7243f082

SHA512
3a9c4c930213e287bff92ae734fc32a23e983b0de90283dfa5e1173ece993ae285c49e479f7964709f40774c42e89dec1f187793d83e97e3aa55f4d3d6439521

Download Submit
memory/2544-51-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2544-53-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2604-29-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2604-41-0x0000000000670000-0x00000000006A1000-memory.dmp

Filesize
196KB

Download
memory/2604-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3036-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3036-13-0x0000000002B00000-0x0000000002B31000-memory.dmp

Filesize
196KB

Download
memory/3036-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download