Malware Analysis Report

2024-07-28 15:15

Sample ID 240613-172nxaseka
Target 475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593
SHA256 475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593

Threat Level: Known bad

The file 475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593 was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Modifies Installed Components in the registry

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Defense Evasion
TA0005
Modify Registry
T1112
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 22:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 22:18

Reported

2024-06-13 22:20

Platform

win7-20240611-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2652 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe \??\c:\windows\system\explorer.exe
PID 2652 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe \??\c:\windows\system\explorer.exe
PID 2652 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe \??\c:\windows\system\explorer.exe
PID 2652 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe \??\c:\windows\system\explorer.exe
PID 2924 wrote to memory of 2964 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2924 wrote to memory of 2964 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2924 wrote to memory of 2964 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2924 wrote to memory of 2964 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2964 wrote to memory of 2596 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2964 wrote to memory of 2596 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2964 wrote to memory of 2596 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2964 wrote to memory of 2596 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2596 wrote to memory of 2568 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2596 wrote to memory of 2568 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2596 wrote to memory of 2568 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2596 wrote to memory of 2568 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2596 wrote to memory of 1860 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1860 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1860 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1860 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1672 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1672 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1672 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1672 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1996 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1996 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1996 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2596 wrote to memory of 1996 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe

"C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 22:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 22:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 22:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

N/A

Files

memory/2652-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2652-1-0x0000000000020000-0x0000000000024000-memory.dmp

memory/2652-2-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2652-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2652-4-0x0000000000401000-0x000000000042E000-memory.dmp

\Windows\system\explorer.exe

MD5 b18cf3b117495ceebc891231714f69f9
SHA1 f88743e1fe36bc6a2e29f1730f9d96adf2b6f876
SHA256 cf4ac1aed96000f95bf0bf8852f6900cd6ed9bf24a674eab147fbfcb8ffe20dc
SHA512 2326984f90bbde9f0d777fd58106472b4eb48cb60a846da84f8fed074813c3ba2fec8b91c6bb1f90398e1e0daed663420d1aadadd5d77a78e3249ed33a51009b

memory/2652-16-0x0000000002460000-0x0000000002491000-memory.dmp

memory/2924-21-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2924-20-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2924-18-0x0000000072940000-0x0000000072A93000-memory.dmp

\Windows\system\spoolsv.exe

MD5 8de24227b56941a7b53288d20e6f8d10
SHA1 600eed08e4740d094eeb6f6fc3a8a65fe588d087
SHA256 cb7440816a9f5b523db11eb0fd7e58e33220d431f3d6602d54bd2040526e43f8
SHA512 345bd30402b2417b382485280d189bf9badade45345eb6007afce4e9b3e0694a07933eec05ec0da88439a28415bdb8e9210049a40ec705625de2e56f80a8d689

memory/2924-35-0x0000000000440000-0x0000000000471000-memory.dmp

memory/2964-36-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2964-41-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\svchost.exe

MD5 25ec5894d5744321d68c74551fe77b05
SHA1 f1e4cb652124be6f320d9a72529fce66258fe4a8
SHA256 0c94b9516256546f17130c269f65397544fb2f198208acb7cbd085764711a95d
SHA512 85e9572aab99ce0fc6c2f85b981224ff1ce67727582ca080e4be6f752f0a09156da01a673395e50372c12503c6020c5efe28453872367696318aa6f296f0836e

memory/2964-53-0x0000000002C70000-0x0000000002CA1000-memory.dmp

memory/2596-54-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2596-58-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2964-52-0x0000000002C70000-0x0000000002CA1000-memory.dmp

memory/2568-65-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2596-64-0x0000000001DC0000-0x0000000001DF1000-memory.dmp

memory/2568-66-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2568-71-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2652-77-0x0000000000401000-0x000000000042E000-memory.dmp

memory/2652-76-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 6dc7048523c5c512d5c6414fc2cd2141
SHA1 c853847a57eff5314f89488ebbb28f407495448e
SHA256 b5de36f5b5b743b1f782d376da51515323fbc304d103124b4b21a14b23893a0a
SHA512 8c49036ba8663d4744fd7ade3a5b4478a7553938e76173fd75304fb62a527ad05c90348fdaca82b0874d2ffb746f7d96e0a3de8448642a4fb0664edd799c6f2c

memory/2924-79-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2596-80-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2924-89-0x0000000000400000-0x0000000000431000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:18

Reported

2024-06-13 22:20

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2944 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe \??\c:\windows\system\explorer.exe
PID 2944 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe \??\c:\windows\system\explorer.exe
PID 2944 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe \??\c:\windows\system\explorer.exe
PID 808 wrote to memory of 2008 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 808 wrote to memory of 2008 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 808 wrote to memory of 2008 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2008 wrote to memory of 220 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2008 wrote to memory of 220 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2008 wrote to memory of 220 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 220 wrote to memory of 2560 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 220 wrote to memory of 2560 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 220 wrote to memory of 2560 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 220 wrote to memory of 4316 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 220 wrote to memory of 4316 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 220 wrote to memory of 4316 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 220 wrote to memory of 4860 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 220 wrote to memory of 4860 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 220 wrote to memory of 4860 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 220 wrote to memory of 4556 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 220 wrote to memory of 4556 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 220 wrote to memory of 4556 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe

"C:\Users\Admin\AppData\Local\Temp\475c1ab12499b9455ab64d12dc1b405dc4f09324f48b819cdc9f6537517a5593.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 22:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 22:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 22:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/2944-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

memory/2944-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2944-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2944-2-0x0000000074E00000-0x0000000074F5D000-memory.dmp

memory/2944-4-0x0000000000401000-0x000000000042E000-memory.dmp

C:\Windows\System\explorer.exe

MD5 15d13165dee194007b25f7872716e3c0
SHA1 d602cceb73842a3d62b8b68a66e9e13bc9928922
SHA256 0f9b44b4767ae9498255023ab1f9a272cb550aae3d6ef2f373a92b13cdd38086
SHA512 81ac2f5316a1ee9d14c11fee6a6f257dec4e93d61f11f706735995786beff1c2018984bd13a2524d6c18039e0499f23f6cf2ed22ef61c79efd4638ccfa1db3bd

memory/808-13-0x0000000074E00000-0x0000000074F5D000-memory.dmp

memory/808-16-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 538bace0e551b7559056366fe2621b55
SHA1 1e5f40364654d85aa18ca6362bb463f4d2cd2c98
SHA256 f11763b29fbf14379e81c05507e7907859a516cccd55f4ffb2375ecd35467796
SHA512 66b4d1d9460f50402da6ef392ea4ddd7b601c8e9d1b83f654180a12d46f32d397727dd93d1ed41cb5b8c187d82ff207a8333556915c1cf7bb5e53ede26c7934e

memory/2008-24-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2008-25-0x0000000074E00000-0x0000000074F5D000-memory.dmp

C:\Windows\System\svchost.exe

MD5 a4df163255b9a36fcbd7651ac2614fe3
SHA1 da5c6338f636f10049907329c035cbc4cefaf99e
SHA256 1910d58f84aac141244915ea97e5e16b04a4001fb2a1c85573a3804a83ddbc2c
SHA512 294999db060d745341fdbac55660f773aa86b7391d29c8d53e0450d2befa62086856c5f54d8143cbd1dbf4fb33a189d33c2a575f7a7879df14cf60b98612def6

memory/220-35-0x0000000000400000-0x0000000000431000-memory.dmp

memory/220-40-0x0000000000400000-0x0000000000431000-memory.dmp

memory/220-36-0x0000000074E00000-0x0000000074F5D000-memory.dmp

memory/2560-43-0x0000000074E00000-0x0000000074F5D000-memory.dmp

memory/2560-48-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2008-52-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2944-54-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2944-55-0x0000000000401000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 388aa20b8f39c9f0d7c6ee79b884c310
SHA1 b39a8c33e39c498695d370bf5e52591ce13c56e0
SHA256 aa9c19a2526b1fdf452424115d198540bcc3bb0ffd2022b8b81a386dad5df481
SHA512 ff7dcd9642fb2c0e68cba7559f39a20307fe82cf1b326d7c2b9e7a91c4c435fc8efd28d34c3585d766b08f36306ce357dada3c6d020a29fa1280d1acfe38088a

memory/808-57-0x0000000000400000-0x0000000000431000-memory.dmp

memory/220-59-0x0000000000400000-0x0000000000431000-memory.dmp

memory/808-68-0x0000000000400000-0x0000000000431000-memory.dmp