82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe
Size 66KB
Sample240614-a5vjpsyara
SHA256 82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3
MD5 3370da3abf61aff20fa86f19c1a6ad5f
SHA1 b4ab378c8af69a4f12a9a1af36784d4343c13f53
SHA512 a21ec06de894d05218353da085169ca396a32591d53d48628b815d0a0ab832c2eb22879c26e68925f4c145904c4d750c30329ddb6c14bdac538f15743c700a7d
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiQ:IeklMMYJhqezw/pXzH9iQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1928	explorer.exe
1508	spoolsv.exe
2488	svchost.exe
912	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1708	82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe
1708	82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
2488	svchost.exe
2488	svchost.exe
2488	svchost.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
2488	svchost.exe
1928	explorer.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
1928	explorer.exe
2488	svchost.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
1928	explorer.exe
2488	svchost.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
2488	svchost.exe
1928	explorer.exe
1928	explorer.exe
2488	svchost.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe
2488	svchost.exe
1928	explorer.exe
1928	explorer.exe
2488	svchost.exe
1928	explorer.exe
2488	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1928	explorer.exe
2488	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1708	82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe
1708	82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe
1928	explorer.exe
1928	explorer.exe
1508	spoolsv.exe
1508	spoolsv.exe
2488	svchost.exe
2488	svchost.exe
912	spoolsv.exe
912	spoolsv.exe
1928	explorer.exe
1928	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1928	1708	82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe	81
PID 1708 wrote to memory of 1928	1708	82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe	81
PID 1708 wrote to memory of 1928	1708	82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe	81
PID 1928 wrote to memory of 1508	1928	explorer.exe	83
PID 1928 wrote to memory of 1508	1928	explorer.exe	83
PID 1928 wrote to memory of 1508	1928	explorer.exe	83
PID 1508 wrote to memory of 2488	1508	spoolsv.exe	84
PID 1508 wrote to memory of 2488	1508	spoolsv.exe	84
PID 1508 wrote to memory of 2488	1508	spoolsv.exe	84
PID 2488 wrote to memory of 912	2488	svchost.exe	86
PID 2488 wrote to memory of 912	2488	svchost.exe	86
PID 2488 wrote to memory of 912	2488	svchost.exe	86
PID 2488 wrote to memory of 3652	2488	svchost.exe	87
PID 2488 wrote to memory of 3652	2488	svchost.exe	87
PID 2488 wrote to memory of 3652	2488	svchost.exe	87
PID 2488 wrote to memory of 3608	2488	svchost.exe	93
PID 2488 wrote to memory of 3608	2488	svchost.exe	93
PID 2488 wrote to memory of 3608	2488	svchost.exe	93
PID 2488 wrote to memory of 1432	2488	svchost.exe	95
PID 2488 wrote to memory of 1432	2488	svchost.exe	95
PID 2488 wrote to memory of 1432	2488	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe
"C:\Users\Admin\AppData\Local\Temp\82938c1b21560baddf49ee0a5d3e1c1f8c0b016e6cc099de3e7ea368f89046a3.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1928
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:912
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3652
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:51 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3608
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:52 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 f69266a0e66720dcd3e6727c6a614bd11c493bc7255baee3e53deb0a60d6bd90
MD5 1edcfef7a680a5fa4de8cd1c584aa795
SHA1 2fb5a244c7542021befc1531b828b3d8a52a4253
SHA512 7988ecb952db841dab1ffe58701cc0d58ebafa670863f67216ebbf49d3519b648b0aa1704c584f89ed754d341e65c63b29445700795f3bef2629676abf5c1bb7
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiR44444444444444444444Q:IeklMMYJhqezw/pXzH9iO
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 66KB
SHA256 66c55c2a5f68ab4b4a627408f317279c5097c961ed35a7155d6c0c76b8bbcd78
MD5 89edf715941ef12c65e967e2a219f706
SHA1 1713606e9291a188f3efa70b39e17eb40fb4edc5
SHA512 009abff034df8d69f061ec1600fe5cac586aab32382715d853737d6d4db48a51553e8726f30e9ccfb03d362842e312cc23f32c51fe60d01dfdc37cab553b0a65
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiV:IeklMMYJhqezw/pXzH9iV
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 cb501941e2ae4ba003e4e9a3f5018fe2e4faebc64ee31f921eb6f96eaa3cebf0
MD5 8252b11d2e3355583604d2236f4b431b
SHA1 79201495beebc77e23f20beff0fc54755f3046b0
SHA512 7ea508306eb0b98453b4a9dae88e1829ec3a2ceea34e951e836797dd1abd9054958b4fe9e4ea6cae4982e7a9ba38f975d9eecdc1e336a08c9d0fb2817374c51d
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXip:IeklMMYJhqezw/pXzH9ip
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 162132e009acb2e9e67d088d0b46164feafb828d2a98ffca94aa46a0cd701f9d
MD5 a644ab9dadf6923ab80dc6d511997f0b
SHA1 b0df89185a9967bc7bc2be07488c96b437d2d123
SHA512 29f273ab280f2f9f320c6435c83a1ae998b658d3f6cc63493cf8dd6194bc6feb0a35c7f10fed604c35172a7739a17f694585a63b9f0e288053c80acd76b26936
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi4:IeklMMYJhqezw/pXzH9i4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/912-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/912-46-0x0000000075000000-0x000000007515D000-memory.dmp

Download

memory/1508-26-0x0000000075000000-0x000000007515D000-memory.dmp

Download

memory/1508-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1508-29-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1508-30-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1708-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/1708-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1708-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1708-2-0x0000000075000000-0x000000007515D000-memory.dmp

Download

memory/1708-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1708-59-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1708-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1928-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1928-14-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1928-15-0x0000000075000000-0x000000007515D000-memory.dmp

Download

memory/1928-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1928-71-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1928-19-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2488-44-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2488-39-0x0000000075000000-0x000000007515D000-memory.dmp

Download

memory/2488-37-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2488-62-0x0000000000400000-0x0000000000431000-memory.dmp

Download