475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593

General

Target

475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe
Size

66KB
MD5

1afc4ee33eec9dae3545816ff451ba11
SHA1

6463f7d76707103aa29f65e289ba67a13e99afd9
SHA256

475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593
SHA512

943e194b4f42a756d3af8609771fad0a54ef190ae18889c8230447c3759957560dba54e0a2ae9b065f9c7a510bca6d71ae98c00a5abbaf95baa7e404aa7e329f
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiY:IeklMMYJhqezw/pXzH9iY

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2924 explorer.exe
2964 spoolsv.exe
2596 svchost.exe
2568 spoolsv.exe

pid	process
2924	explorer.exe
2964	spoolsv.exe
2596	svchost.exe
2568	spoolsv.exe

Loads dropped DLL 8 IoCs

Processes:

475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exeexplorer.exespoolsv.exesvchost.exe

pid	process
2652	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe
2652	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe
2924	explorer.exe
2924	explorer.exe
2964	spoolsv.exe
2964	spoolsv.exe
2596	svchost.exe
2596	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

Processes:

475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exeexplorer.exespoolsv.exesvchost.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exeexplorer.exesvchost.exe

pid	process
2652	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe
2924	explorer.exe
2924	explorer.exe
2924	explorer.exe
2596	svchost.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe
2924	explorer.exe
2596	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2924 explorer.exe
2596 svchost.exe

pid	process
2924	explorer.exe
2596	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2652	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe
2652	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe
2924	explorer.exe
2924	explorer.exe
2964	spoolsv.exe
2964	spoolsv.exe
2596	svchost.exe
2596	svchost.exe
2568	spoolsv.exe
2568	spoolsv.exe
2924	explorer.exe
2924	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2652 wrote to memory of 2924	2652	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe	explorer.exe
PID 2652 wrote to memory of 2924	2652	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe	explorer.exe
PID 2652 wrote to memory of 2924	2652	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe	explorer.exe
PID 2652 wrote to memory of 2924	2652	475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe	explorer.exe
PID 2924 wrote to memory of 2964	2924	explorer.exe	spoolsv.exe
PID 2924 wrote to memory of 2964	2924	explorer.exe	spoolsv.exe
PID 2924 wrote to memory of 2964	2924	explorer.exe	spoolsv.exe
PID 2924 wrote to memory of 2964	2924	explorer.exe	spoolsv.exe
PID 2964 wrote to memory of 2596	2964	spoolsv.exe	svchost.exe
PID 2964 wrote to memory of 2596	2964	spoolsv.exe	svchost.exe
PID 2964 wrote to memory of 2596	2964	spoolsv.exe	svchost.exe
PID 2964 wrote to memory of 2596	2964	spoolsv.exe	svchost.exe
PID 2596 wrote to memory of 2568	2596	svchost.exe	spoolsv.exe
PID 2596 wrote to memory of 2568	2596	svchost.exe	spoolsv.exe
PID 2596 wrote to memory of 2568	2596	svchost.exe	spoolsv.exe
PID 2596 wrote to memory of 2568	2596	svchost.exe	spoolsv.exe
PID 2596 wrote to memory of 1860	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1860	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1860	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1860	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1672	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1672	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1672	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1672	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1996	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1996	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1996	2596	svchost.exe	at.exe
PID 2596 wrote to memory of 1996	2596	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe
"C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe PR
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2568

C:\Windows\SysWOW64\at.exe
at 22:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:1860

C:\Windows\SysWOW64\at.exe
at 22:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:1672

C:\Windows\SysWOW64\at.exe
at 22:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:1996

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe
Filesize
66KB

MD5
6dc7048523c5c512d5c6414fc2cd2141

SHA1
c853847a57eff5314f89488ebbb28f407495448e

SHA256
b5de36f5b5b743b1f782d376da51515323fbc304d103124b4b21a14b23893a0a

SHA512
8c49036ba8663d4744fd7ade3a5b4478a7553938e76173fd75304fb62a527ad05c90348fdaca82b0874d2ffb746f7d96e0a3de8448642a4fb0664edd799c6f2c

Download Submit
\??\PIPE\atsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\system\explorer.exe
Filesize
66KB

MD5
b18cf3b117495ceebc891231714f69f9

SHA1
f88743e1fe36bc6a2e29f1730f9d96adf2b6f876

SHA256
cf4ac1aed96000f95bf0bf8852f6900cd6ed9bf24a674eab147fbfcb8ffe20dc

SHA512
2326984f90bbde9f0d777fd58106472b4eb48cb60a846da84f8fed074813c3ba2fec8b91c6bb1f90398e1e0daed663420d1aadadd5d77a78e3249ed33a51009b

Download Submit
\Windows\system\spoolsv.exe
Filesize
66KB

MD5
8de24227b56941a7b53288d20e6f8d10

SHA1
600eed08e4740d094eeb6f6fc3a8a65fe588d087

SHA256
cb7440816a9f5b523db11eb0fd7e58e33220d431f3d6602d54bd2040526e43f8

SHA512
345bd30402b2417b382485280d189bf9badade45345eb6007afce4e9b3e0694a07933eec05ec0da88439a28415bdb8e9210049a40ec705625de2e56f80a8d689

Download Submit
\Windows\system\svchost.exe
Filesize
66KB

MD5
25ec5894d5744321d68c74551fe77b05

SHA1
f1e4cb652124be6f320d9a72529fce66258fe4a8

SHA256
0c94b9516256546f17130c269f65397544fb2f198208acb7cbd085764711a95d

SHA512
85e9572aab99ce0fc6c2f85b981224ff1ce67727582ca080e4be6f752f0a09156da01a673395e50372c12503c6020c5efe28453872367696318aa6f296f0836e

Download Submit
memory/2568-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2568-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2568-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2596-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2596-64-0x0000000001DC0000-0x0000000001DF1000-memory.dmp

Filesize
196KB

Download
memory/2596-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2596-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2652-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2652-77-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2652-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2652-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2652-16-0x0000000002460000-0x0000000002491000-memory.dmp

Filesize
196KB

Download
memory/2652-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2652-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2652-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2924-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2924-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2924-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2924-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2924-35-0x0000000000440000-0x0000000000471000-memory.dmp

Filesize
196KB

Download
memory/2924-89-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2964-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2964-52-0x0000000002C70000-0x0000000002CA1000-memory.dmp

Filesize
196KB

Download
memory/2964-53-0x0000000002C70000-0x0000000002CA1000-memory.dmp

Filesize
196KB

Download
memory/2964-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads