4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e

General

Target

4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe
Size

65KB
MD5

70c35d668d0506e94a29f3cd95c3687a
SHA1

2d460c83d5d6fe3835ca595ce35b420b3b90443d
SHA256

4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e
SHA512

609837bf04451f65a072ecede018f99ef71fb696e6323b1542d6dc5fba28aeffbe13ce2864dc8bdd3fe935b4405fe73e3c8ede64e41d47dcbef3b28466812a64
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuWppppppppppppppppppq:7WNqkOJWmo1HpM0MkTUmup

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2904 explorer.exe
3032 spoolsv.exe
1028 svchost.exe
3724 spoolsv.exe

pid	process
2904	explorer.exe
3032	spoolsv.exe
1028	svchost.exe
3724	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

Processes:

spoolsv.exeexplorer.exesvchost.exe4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exeexplorer.exesvchost.exe

pid	process
3448	4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe
3448	4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
1028	svchost.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
1028	svchost.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
2904	explorer.exe
1028	svchost.exe
1028	svchost.exe
2904	explorer.exe
1028	svchost.exe
2904	explorer.exe
1028	svchost.exe
2904	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2904 explorer.exe
1028 svchost.exe

pid	process
2904	explorer.exe
1028	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
3448	4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe
3448	4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe
2904	explorer.exe
2904	explorer.exe
3032	spoolsv.exe
3032	spoolsv.exe
1028	svchost.exe
1028	svchost.exe
3724	spoolsv.exe
3724	spoolsv.exe
2904	explorer.exe
2904	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 3448 wrote to memory of 2904	3448	4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe	explorer.exe
PID 3448 wrote to memory of 2904	3448	4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe	explorer.exe
PID 3448 wrote to memory of 2904	3448	4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe	explorer.exe
PID 2904 wrote to memory of 3032	2904	explorer.exe	spoolsv.exe
PID 2904 wrote to memory of 3032	2904	explorer.exe	spoolsv.exe
PID 2904 wrote to memory of 3032	2904	explorer.exe	spoolsv.exe
PID 3032 wrote to memory of 1028	3032	spoolsv.exe	svchost.exe
PID 3032 wrote to memory of 1028	3032	spoolsv.exe	svchost.exe
PID 3032 wrote to memory of 1028	3032	spoolsv.exe	svchost.exe
PID 1028 wrote to memory of 3724	1028	svchost.exe	spoolsv.exe
PID 1028 wrote to memory of 3724	1028	svchost.exe	spoolsv.exe
PID 1028 wrote to memory of 3724	1028	svchost.exe	spoolsv.exe
PID 1028 wrote to memory of 3392	1028	svchost.exe	at.exe
PID 1028 wrote to memory of 3392	1028	svchost.exe	at.exe
PID 1028 wrote to memory of 3392	1028	svchost.exe	at.exe
PID 1028 wrote to memory of 4728	1028	svchost.exe	at.exe
PID 1028 wrote to memory of 4728	1028	svchost.exe	at.exe
PID 1028 wrote to memory of 4728	1028	svchost.exe	at.exe
PID 1028 wrote to memory of 4364	1028	svchost.exe	at.exe
PID 1028 wrote to memory of 4364	1028	svchost.exe	at.exe
PID 1028 wrote to memory of 4364	1028	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe
"C:\Users\Admin\AppData\Local\Temp\4230c744b44b026252ec0961b884a77e164ceae1eec514e0b724c223afbdd90e.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe PR
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3724

C:\Windows\SysWOW64\at.exe
at 22:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:3392

C:\Windows\SysWOW64\at.exe
at 22:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:4728

C:\Windows\SysWOW64\at.exe
at 22:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
1⤵
PID:116

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe
Filesize
65KB

MD5
7b1eb5e40eb090b6883c667152fb7910

SHA1
2a9d815b6354b7cd28434a0801e25e89dfc88e33

SHA256
bf51abb0835af61962e127020009f5cfa9075b489ea3f7c885c38ee4458d07ea

SHA512
d59566db6ebb253576db51da86baba5ef3eebe4c0f5414d99c9f24c3c0168b27c7b19410e830220872ae104680b3715fbd1c27007bbb698f5636b4ad73b20314

Download Submit
C:\Windows\System\explorer.exe
Filesize
65KB

MD5
a5c4f007ed066cd3a3be49449f262d73

SHA1
4fca605b70c767e465879f09cbc91b6f41924a4e

SHA256
9a4b1b367248e118aeac3fab6c62dd08ac05c967a8bbe47fe0954b6a68242c79

SHA512
91f4322e7c5cf69fb6559b4199c920b91d18d9b9d5ac6dd5b3e47484cc541df481719d0d514aad48845ea463456770f4a789f6a1089435894b8ce8544756259b

Download Submit
C:\Windows\System\spoolsv.exe
Filesize
65KB

MD5
5c3e728f1b50ecb00507d20685634e52

SHA1
13e056ba82edcaf43be0313f250b85e0b0273bf0

SHA256
9c5f0f661ee1049f8e4b8655e70e3ece6be9659acdea82ddc8091fdc93ddf27c

SHA512
34eecd7d5aa9fe97538e8996f35a80c1e504e61067a4a51c7dc1010c4c169d5634416724d8de5eebf3c76ff3022c75ff79e6e978b6b8411414952b1f057d30fa

Download Submit
C:\Windows\System\svchost.exe
Filesize
65KB

MD5
c3d6909e4855d9bdf1c2b5642f193143

SHA1
95741ffbefc9e2fb046b1a6a3bd508ccd301e8e6

SHA256
368c12ee5a01e241defd29e94dd0a665f585d2f72f30800a00b05f5f31eb4e08

SHA512
1bf11dc54797a26f05507b433149683c02d2a36b84e6195867885d6dcea146b7d4c5348b374187c78dbe03e46a1f36fe968414096b5dbb64cfe82bcccd3e55ea

Download Submit
memory/1028-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1028-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1028-37-0x00000000755F0000-0x000000007574D000-memory.dmp

Filesize
1.4MB

Download
memory/1028-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-14-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-15-0x00000000755F0000-0x000000007574D000-memory.dmp

Filesize
1.4MB

Download
memory/2904-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3032-31-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3032-26-0x00000000755F0000-0x000000007574D000-memory.dmp

Filesize
1.4MB

Download
memory/3032-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3448-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3448-45-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/3448-60-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3448-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3448-2-0x00000000755F0000-0x000000007574D000-memory.dmp

Filesize
1.4MB

Download
memory/3448-5-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3448-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3448-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/3724-46-0x00000000755F0000-0x000000007574D000-memory.dmp

Filesize
1.4MB

Download
memory/3724-52-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads