40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3

General

Target

40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe
Size

66KB
MD5

413662d111665c07348cb24c4b4e7b70
SHA1

acc2db7b38796b161439324ecc24a8268733f914
SHA256

40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3
SHA512

13f0e941005fbdd2d219c0ad2f129ad0d8472af33813a0cdd1f28963df7018aff1ac26205eb588127d6e132705ef4e0fde747d6b3dae852c6ae9ac5972e5c1d4
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi6:IeklMMYJhqezw/pXzH9i6

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2480 explorer.exe
2348 spoolsv.exe
4644 svchost.exe
3620 spoolsv.exe

pid	process
2480	explorer.exe
2348	spoolsv.exe
4644	svchost.exe
3620	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exeexplorer.exe40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exeexplorer.exesvchost.exe

pid	process
3536	40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe
3536	40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
4644	svchost.exe
2480	explorer.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
4644	svchost.exe
2480	explorer.exe
2480	explorer.exe
4644	svchost.exe
4644	svchost.exe
2480	explorer.exe
2480	explorer.exe
4644	svchost.exe
4644	svchost.exe
2480	explorer.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe
2480	explorer.exe
4644	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2480 explorer.exe
4644 svchost.exe

pid	process
2480	explorer.exe
4644	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
3536	40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe
3536	40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe
2480	explorer.exe
2480	explorer.exe
2348	spoolsv.exe
2348	spoolsv.exe
4644	svchost.exe
4644	svchost.exe
3620	spoolsv.exe
3620	spoolsv.exe
2480	explorer.exe
2480	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 3536 wrote to memory of 2480	3536	40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe	explorer.exe
PID 3536 wrote to memory of 2480	3536	40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe	explorer.exe
PID 3536 wrote to memory of 2480	3536	40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe	explorer.exe
PID 2480 wrote to memory of 2348	2480	explorer.exe	spoolsv.exe
PID 2480 wrote to memory of 2348	2480	explorer.exe	spoolsv.exe
PID 2480 wrote to memory of 2348	2480	explorer.exe	spoolsv.exe
PID 2348 wrote to memory of 4644	2348	spoolsv.exe	svchost.exe
PID 2348 wrote to memory of 4644	2348	spoolsv.exe	svchost.exe
PID 2348 wrote to memory of 4644	2348	spoolsv.exe	svchost.exe
PID 4644 wrote to memory of 3620	4644	svchost.exe	spoolsv.exe
PID 4644 wrote to memory of 3620	4644	svchost.exe	spoolsv.exe
PID 4644 wrote to memory of 3620	4644	svchost.exe	spoolsv.exe
PID 4644 wrote to memory of 4992	4644	svchost.exe	at.exe
PID 4644 wrote to memory of 4992	4644	svchost.exe	at.exe
PID 4644 wrote to memory of 4992	4644	svchost.exe	at.exe
PID 4644 wrote to memory of 2980	4644	svchost.exe	at.exe
PID 4644 wrote to memory of 2980	4644	svchost.exe	at.exe
PID 4644 wrote to memory of 2980	4644	svchost.exe	at.exe
PID 4644 wrote to memory of 4112	4644	svchost.exe	at.exe
PID 4644 wrote to memory of 4112	4644	svchost.exe	at.exe
PID 4644 wrote to memory of 4112	4644	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe
"C:\Users\Admin\AppData\Local\Temp\40774a3ade92d309177f3dadedd89e4dba5a5d65ab757ac2a35b03c76b328fb3.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe PR
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3620

C:\Windows\SysWOW64\at.exe
at 22:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:4992

C:\Windows\SysWOW64\at.exe
at 22:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:2980

C:\Windows\SysWOW64\at.exe
at 22:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:4112

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe
Filesize
66KB

MD5
65e6b99eec5499c9bb0c447c0a690050

SHA1
030a30342f48d2bcfe8cdab5322d5c59c3ea269a

SHA256
c42d5a7fe33edb0ff8ebd3138b8902cd3848bf4fae0386e00e43ff09986b1645

SHA512
4a67e4fa6a64dfd01d59c38d12b0bed1801063801611f6d7519c68d4ff072c660f8cbf7be927a0177d9c23fa13a9302da0e4cea0a053a9ce25acd8bb032d3e1b

Download Submit
C:\Windows\System\spoolsv.exe
Filesize
66KB

MD5
0886f2cd450e79c6ff26765839c07b0b

SHA1
7f0de4b2b46cf2ea9fdaa77562109bd62ba7809d

SHA256
611ada94f4313b3772d8935b1504590a9a675b73a23ffcb1131be57b911fea5c

SHA512
08b6792ba259afb055bfc777addac75548b43bf76e9d00031a56180928e9bd8db05b6f1ccca513e65406940bb04162e43154c1bf14aec22aba05e5c2d356d1af

Download Submit
C:\Windows\System\svchost.exe
Filesize
66KB

MD5
32cff0be578e98ab6871f85ba215ce82

SHA1
5d278c9d1ce94d9fb08a76a348367b6d6b972762

SHA256
9a574ee06364103eeec6fdf62273a13d5296bec19ab187087f4b317af25d4b5d

SHA512
bd7bc95a015a6fdb78bd57ec23b8289d020aef3d67751ebed7b21f1fa5f71cc69cc7f97afe10b303bd7fd1e6a84f1da6b7a8ec30329220ea7dba55eb1f05faad

Download Submit
\??\PIPE\atsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\windows\system\explorer.exe
Filesize
66KB

MD5
43fdc245ff3731d0d3e98057745fc9e9

SHA1
3ab92221ab9f31e88aa149954ee88a48bff3c2b6

SHA256
63807ef6a00e10264f0a04b4954326f253770ca3255003c7a25f16fd980cb55c

SHA512
b5cbd549f93deeb964ca3514d7d9ea595886ddf36503bad7da0dc27dd3d8a5fd2cb691de78b51ea87a65c3f7794e8a076f6a94356ee7d47a0f29a7976189c8e4

Download Submit
memory/2348-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2348-27-0x0000000075A00000-0x0000000075B5D000-memory.dmp

Filesize
1.4MB

Download
memory/2348-29-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2348-26-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-14-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-15-0x0000000075A00000-0x0000000075B5D000-memory.dmp

Filesize
1.4MB

Download
memory/2480-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3536-58-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3536-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3536-57-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/3536-2-0x0000000075A00000-0x0000000075B5D000-memory.dmp

Filesize
1.4MB

Download
memory/3536-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3536-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3536-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3536-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/3620-44-0x0000000075A00000-0x0000000075B5D000-memory.dmp

Filesize
1.4MB

Download
memory/3620-52-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4644-38-0x0000000075A00000-0x0000000075B5D000-memory.dmp

Filesize
1.4MB

Download
memory/4644-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads