0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe
Size 65KB
Sample240613-xpjhtsscpm
SHA256 0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7
MD5 4513922f096ea61fca10a938a1ed39f9
SHA1 419f2894d676b54e9545b2935117fe43025d74f5
SHA512 d9a8492dd813356639f60c72f7040891bb3025924740aff9d36fa454ece6c9daea6f344eeaec35e9499c3cb78650efe2b8fab7ca977b47a1885dabdeb1b6274f
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuE:7WNqkOJWmo1HpM0MkTUmuE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2920	explorer.exe
3300	spoolsv.exe
3636	svchost.exe
1940	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
896	0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe
896	0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe
2920	explorer.exe
2920	explorer.exe
2920	explorer.exe
2920	explorer.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe
2920	explorer.exe
2920	explorer.exe
3636	svchost.exe
3636	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2920	explorer.exe
3636	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
896	0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe
896	0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe
2920	explorer.exe
2920	explorer.exe
3300	spoolsv.exe
3300	spoolsv.exe
3636	svchost.exe
3636	svchost.exe
1940	spoolsv.exe
1940	spoolsv.exe
2920	explorer.exe
2920	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2920	896	0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe	81
PID 896 wrote to memory of 2920	896	0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe	81
PID 896 wrote to memory of 2920	896	0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe	81
PID 2920 wrote to memory of 3300	2920	explorer.exe	82
PID 2920 wrote to memory of 3300	2920	explorer.exe	82
PID 2920 wrote to memory of 3300	2920	explorer.exe	82
PID 3300 wrote to memory of 3636	3300	spoolsv.exe	84
PID 3300 wrote to memory of 3636	3300	spoolsv.exe	84
PID 3300 wrote to memory of 3636	3300	spoolsv.exe	84
PID 3636 wrote to memory of 1940	3636	svchost.exe	86
PID 3636 wrote to memory of 1940	3636	svchost.exe	86
PID 3636 wrote to memory of 1940	3636	svchost.exe	86
PID 3636 wrote to memory of 4324	3636	svchost.exe	87
PID 3636 wrote to memory of 4324	3636	svchost.exe	87
PID 3636 wrote to memory of 4324	3636	svchost.exe	87
PID 3636 wrote to memory of 3832	3636	svchost.exe	98
PID 3636 wrote to memory of 3832	3636	svchost.exe	98
PID 3636 wrote to memory of 3832	3636	svchost.exe	98
PID 3636 wrote to memory of 1188	3636	svchost.exe	100
PID 3636 wrote to memory of 1188	3636	svchost.exe	100
PID 3636 wrote to memory of 1188	3636	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe
"C:\Users\Admin\AppData\Local\Temp\0a1f3f0786bfd47033093a9e23d6b074f4fecff74d7194b41d0720a6850428e7.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4324
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3832
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 badc6aea64d1ecac390a0c748c641217bf015ee603f7c8e240c25e9a997f5557
MD5 3cba66698c8be3b0e1d791c23750827c
SHA1 0b532e4067db4d9c156fc9f991632f1e42f625a0
SHA512 394e8622141edb16318f1007a73005e8aa86c43a46df2b2baecc4eb647f1f77469c0f56435c7a6b1a3d58aa239a12abb0dab3b4172b8ea21e8eb64cccbba14b9
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuR:7WNqkOJWmo1HpM0MkTUmuR
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 0e99042979495b2156a41488aa16043cd41aaae3337e85a7402c8df0a49f70e0
MD5 388192bda4eceeea204b4bec895f65fa
SHA1 309012d01c1ed9a3af7bb55e0437fd7de81c5fd8
SHA512 95ecede24f3989611554896e21c5ed482dcabb69acff8bd17fcb7a7a4cd3f3f4997097c583ce4ba2f6b0026ddedc6bb9383e4a4e45fbd9e4b8959371955035ae
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou7:7WNqkOJWmo1HpM0MkTUmu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 a505cf7ef29754413c58f6bf5f05cb00cc3032ce02546de940532fb49fd7598c
MD5 188b0487e70d7a8409e6cdb058128304
SHA1 df6e824d08c266acdc2dd9a12dbae27c371a84e7
SHA512 02aa67f1a7929ab01728db2eb641803cdfe35fa4b19b1330d5ffae2f24910034567dc1556325820ca967f9b865e9056149f596e94813b6081ff9f3187929751b
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouirrrrrrrrrrrrrrrrrre:7WNqkOJWmo1HpM0MkTUmuirrrrrrrrri
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 5efc08afa0ac15633dd90f30efedf836435cd56d03d7cae0bf08d21e05c91544
MD5 4715eb5d7caeaefb478246aeee4b73ac
SHA1 a4de1d80552b568cd8ae05160ac35c7d25352886
SHA512 b4c58cf2ac51a9509b3dc62136cbcecd42974f45e7ce795daaa8b7c454605a4dedc329f827c5dc15e6a11bbcd5c1f9b74779edf26ee6b427923a7fcd0f6a6f6f
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuO:7WNqkOJWmo1HpM0MkTUmuO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/896-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/896-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/896-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/896-2-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Download

memory/896-57-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/896-5-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/896-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1940-52-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1940-44-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Download

memory/2920-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2920-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2920-69-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2920-14-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Download

memory/2920-18-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3300-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3300-28-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3300-25-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Download

memory/3636-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3636-37-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Download

memory/3636-35-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3636-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download