02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
Size

216KB
MD5

102b222ef289a3791b9bd61bb46483f1
SHA1

baf2de4b3a34e58740969ec40766090543a7c404
SHA256

02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db
SHA512

ab2defc6cf100b482ed60e709aa124b6360643f700a03807754121dcb7e307c43aff814ed545489dae45153f02809da9fb481f6179bcb755a9eedd0102a527e5
SSDEEP

3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9iT:7vEN2U+T6i5LirrllHy4HUcMQY6C9iT

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
804	explorer.exe
772	spoolsv.exe
2980	svchost.exe
3212	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3520	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
3520	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
804	explorer.exe
804	explorer.exe
804	explorer.exe
804	explorer.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe
804	explorer.exe
804	explorer.exe
2980	svchost.exe
2980	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
804	explorer.exe
2980	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3520	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
3520	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
804	explorer.exe
804	explorer.exe
772	spoolsv.exe
772	spoolsv.exe
2980	svchost.exe
2980	svchost.exe
3212	spoolsv.exe
3212	spoolsv.exe
804	explorer.exe
804	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 804	3520	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe	81
PID 3520 wrote to memory of 804	3520	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe	81
PID 3520 wrote to memory of 804	3520	02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe	81
PID 804 wrote to memory of 772	804	explorer.exe	82
PID 804 wrote to memory of 772	804	explorer.exe	82
PID 804 wrote to memory of 772	804	explorer.exe	82
PID 772 wrote to memory of 2980	772	spoolsv.exe	83
PID 772 wrote to memory of 2980	772	spoolsv.exe	83
PID 772 wrote to memory of 2980	772	spoolsv.exe	83
PID 2980 wrote to memory of 3212	2980	svchost.exe	84
PID 2980 wrote to memory of 3212	2980	svchost.exe	84
PID 2980 wrote to memory of 3212	2980	svchost.exe	84
PID 2980 wrote to memory of 3524	2980	svchost.exe	85
PID 2980 wrote to memory of 3524	2980	svchost.exe	85
PID 2980 wrote to memory of 3524	2980	svchost.exe	85
PID 2980 wrote to memory of 4220	2980	svchost.exe	95
PID 2980 wrote to memory of 4220	2980	svchost.exe	95
PID 2980 wrote to memory of 4220	2980	svchost.exe	95
PID 2980 wrote to memory of 2292	2980	svchost.exe	97
PID 2980 wrote to memory of 2292	2980	svchost.exe	97
PID 2980 wrote to memory of 2292	2980	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe
"C:\Users\Admin\AppData\Local\Temp\02b795b1508a79adad1321f7dc4304957f66b19a7ccb6f1f7b51be3a70af63db.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:804
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:772
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3212
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3524
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4220
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
216KB

MD5
1938d08e8d1614104810da79d3e45f0e

SHA1
c9dc9a705fecbc916b1ab9d21e4923d2cc5ce278

SHA256
817236682d6b4a239c752571a5f97f42a22bd4988a9a2156a4a71de8f4c9a349

SHA512
6e7b7440fa11df406e4f0fad2f278d2f0d9472cf85f1a29e4c145cdbbceaf21dfe49950c02158d378d3a0a9f5f54fad3ee669c50703e44b8b7f664002d29fada

Download Submit
C:\Windows\System\explorer.exe

Filesize
216KB

MD5
aef81f7dda750578f853f246178a1966

SHA1
40998acf48492615c5dbcffa2345bc36daf0891d

SHA256
1b1e2dcb8cf0a680e5d619ce775fa960970f25c960cb0362bd598ac6b830e26a

SHA512
59a26e21a2dc9fd84c8f583112c3a9a006848a08e4a2122f970753ae5a4f81c826080a596b678f01e982c78c6759d4557bb33274bb371b2d30d5e4310b391801

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
216KB

MD5
f34132b59d78424a607400f8a8cb7637

SHA1
2207692d07552a32e053cf6f9aa78bad12198aea

SHA256
ef21c73f2bb2a591bec580179f3749cf811cfc563dfbfdf52507ac505cbbeb39

SHA512
9d52f7b6fdb1ac564ac8a837e0a672234181279c3d9e94eeae627d56933c36faed875184d3251051e58302840faedd697fbd3144f429dcef5f65e16f1883ca54

Download Submit
C:\Windows\System\svchost.exe

Filesize
216KB

MD5
7c06372d1c30d5097e1308d28128dc49

SHA1
59c8c4153d7eb97c60081256e77c7218eee8024e

SHA256
b68ae3960c7a371e396a6033da6c193a297e209016a84096ff85961838db114e

SHA512
65a02d2ca9207c6a5824f8efaa653ba6b9c61681d47d6d6bc25f7bf4169dbd7401efca909672e268a7c2978ca00986039c35bf7f0954558e17370d11cb41900c

Download Submit
memory/772-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/772-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3212-33-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3520-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3520-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download