d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe
Size

66KB
MD5

8fd7138f70be771dc1356599c31c3cd6
SHA1

d0dfe1e6ecb6a820af62670f221d1f94193400df
SHA256

d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a
SHA512

49347b0a5cb71370a68059daf2742f5baf7ec29b01478d328de8200339b9a7e9e5d999a5db113e7f32ff68bafd4e0284aa18b94869da5aa44b6b2a97507af425
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXih:IeklMMYJhqezw/pXzH9ih

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2872	explorer.exe
2640	spoolsv.exe
2716	svchost.exe
2592	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2928	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe
2928	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe
2872	explorer.exe
2872	explorer.exe
2640	spoolsv.exe
2640	spoolsv.exe
2716	svchost.exe
2716	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2716	svchost.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe
2872	explorer.exe
2716	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2872	explorer.exe
2716	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2928	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe
2928	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe
2872	explorer.exe
2872	explorer.exe
2640	spoolsv.exe
2640	spoolsv.exe
2716	svchost.exe
2716	svchost.exe
2592	spoolsv.exe
2592	spoolsv.exe
2872	explorer.exe
2872	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2872	2928	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe	28
PID 2928 wrote to memory of 2872	2928	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe	28
PID 2928 wrote to memory of 2872	2928	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe	28
PID 2928 wrote to memory of 2872	2928	d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe	28
PID 2872 wrote to memory of 2640	2872	explorer.exe	29
PID 2872 wrote to memory of 2640	2872	explorer.exe	29
PID 2872 wrote to memory of 2640	2872	explorer.exe	29
PID 2872 wrote to memory of 2640	2872	explorer.exe	29
PID 2640 wrote to memory of 2716	2640	spoolsv.exe	30
PID 2640 wrote to memory of 2716	2640	spoolsv.exe	30
PID 2640 wrote to memory of 2716	2640	spoolsv.exe	30
PID 2640 wrote to memory of 2716	2640	spoolsv.exe	30
PID 2716 wrote to memory of 2592	2716	svchost.exe	31
PID 2716 wrote to memory of 2592	2716	svchost.exe	31
PID 2716 wrote to memory of 2592	2716	svchost.exe	31
PID 2716 wrote to memory of 2592	2716	svchost.exe	31
PID 2716 wrote to memory of 2984	2716	svchost.exe	32
PID 2716 wrote to memory of 2984	2716	svchost.exe	32
PID 2716 wrote to memory of 2984	2716	svchost.exe	32
PID 2716 wrote to memory of 2984	2716	svchost.exe	32
PID 2716 wrote to memory of 1512	2716	svchost.exe	36
PID 2716 wrote to memory of 1512	2716	svchost.exe	36
PID 2716 wrote to memory of 1512	2716	svchost.exe	36
PID 2716 wrote to memory of 1512	2716	svchost.exe	36
PID 2716 wrote to memory of 2244	2716	svchost.exe	38
PID 2716 wrote to memory of 2244	2716	svchost.exe	38
PID 2716 wrote to memory of 2244	2716	svchost.exe	38
PID 2716 wrote to memory of 2244	2716	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe
"C:\Users\Admin\AppData\Local\Temp\d5a72adc53d434da872442a8dd7a88a6f492354baacac6d15bc6d51ba98df75a.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2984
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1512
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
b3a80981481e38e7988bbc628c5e3d40

SHA1
9512c03411e03b2040be0fc5255546d484492db3

SHA256
c9dbd1bf7cdf928c8a279b38bca2a82960b12432ae2d6cfb25d81029c39bc7db

SHA512
da60860574fdd6431cbc0ee2c3c3e6d01fef3060f897b9317b241e3c2efd5786ab2fb9323bc1f85b75bfbbd6dd55be54535aeb31453333e108dce8d18edc7e7f

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
5d65d9e6456448c52ffefb6798e63b08

SHA1
bcd32a57b4d5604b9b668f6642437d82785fadfb

SHA256
b81a80ebb7338c9e7fa9021eade1dd00cb1c55c3c76a38da3ea77adb06a11d76

SHA512
1788fda5703b8c3aa47b666d2cca190b73a8c45b45f769354fbe995ffaff8ad861ee77d59bcc214fd84bd44b5121c61456ecd39310ddeef42c74ca8a2b3d7ffd

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
2b7ccbe7c42aaa8a73a3123cf993e5d0

SHA1
94c0618902812c8ff12c16ffd0e47a1a995e49d5

SHA256
c5ecbf24160e6ad17dec2f6f588fbc9f9d3156c8f6dfe737dc88feb539b89533

SHA512
4abd568a9395f7e4352627e6cc4a58c5cc15a8cad0e65dd4fb9a9e3fe0e53654d9834396ce7fa1a701f5bc0cbccbd65dffcfbf35b28cb699268c1ab9cc761154

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
d1eea0b724240a1583ed73bd02da334a

SHA1
6b0a115e0ff15c168e72982be544d43afc792853

SHA256
0543287f11d02ef69276c786d538b4e7367e4148e2498da55ce86b4cace9b1ac

SHA512
887f069556560b2de92922f776ca3a0985ae5a547e28a1dfb0286bc54a7d18fa17275e38990701d98d98d604a9430f196e06e0b34620aa016c9cf9ca5915acae

Download Submit
memory/2592-64-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2592-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2640-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2640-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2640-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2640-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-63-0x0000000002570000-0x00000000025A1000-memory.dmp

Filesize
196KB

Download
memory/2716-53-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2716-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-17-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2872-30-0x0000000001DA0000-0x0000000001DD1000-memory.dmp

Filesize
196KB

Download
memory/2872-90-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2928-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2928-19-0x0000000002710000-0x0000000002741000-memory.dmp

Filesize
196KB

Download
memory/2928-77-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2928-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2928-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2928-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2928-62-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2928-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2928-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2928-20-0x0000000002710000-0x0000000002741000-memory.dmp

Filesize
196KB

Download