76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe
Size

66KB
MD5

aafde44d02ce89c9f133baa4c5a9cbf9
SHA1

c65f2ab0065f847390ea811dc6bc9a9b23d0fbfb
SHA256

76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b
SHA512

ae6c0d8a41c89afaed1a5d4fcd045b81d68a94da0c4e5160929ac7acc599f028976046a2481d121d8958a31fc9f622e8e8b20a29b89f7449066c36a9802d56cc
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXik:IeklMMYJhqezw/pXzH9ik

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2732	explorer.exe
2700	spoolsv.exe
2336	svchost.exe
2464	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2068	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe
2068	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe
2732	explorer.exe
2732	explorer.exe
2700	spoolsv.exe
2700	spoolsv.exe
2336	svchost.exe
2336	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2068	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2336	svchost.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe
2732	explorer.exe
2336	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2732	explorer.exe
2336	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2068	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe
2068	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe
2732	explorer.exe
2732	explorer.exe
2700	spoolsv.exe
2700	spoolsv.exe
2336	svchost.exe
2336	svchost.exe
2464	spoolsv.exe
2464	spoolsv.exe
2732	explorer.exe
2732	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2732	2068	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe	28
PID 2068 wrote to memory of 2732	2068	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe	28
PID 2068 wrote to memory of 2732	2068	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe	28
PID 2068 wrote to memory of 2732	2068	76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe	28
PID 2732 wrote to memory of 2700	2732	explorer.exe	29
PID 2732 wrote to memory of 2700	2732	explorer.exe	29
PID 2732 wrote to memory of 2700	2732	explorer.exe	29
PID 2732 wrote to memory of 2700	2732	explorer.exe	29
PID 2700 wrote to memory of 2336	2700	spoolsv.exe	30
PID 2700 wrote to memory of 2336	2700	spoolsv.exe	30
PID 2700 wrote to memory of 2336	2700	spoolsv.exe	30
PID 2700 wrote to memory of 2336	2700	spoolsv.exe	30
PID 2336 wrote to memory of 2464	2336	svchost.exe	31
PID 2336 wrote to memory of 2464	2336	svchost.exe	31
PID 2336 wrote to memory of 2464	2336	svchost.exe	31
PID 2336 wrote to memory of 2464	2336	svchost.exe	31
PID 2336 wrote to memory of 276	2336	svchost.exe	32
PID 2336 wrote to memory of 276	2336	svchost.exe	32
PID 2336 wrote to memory of 276	2336	svchost.exe	32
PID 2336 wrote to memory of 276	2336	svchost.exe	32
PID 2336 wrote to memory of 1516	2336	svchost.exe	36
PID 2336 wrote to memory of 1516	2336	svchost.exe	36
PID 2336 wrote to memory of 1516	2336	svchost.exe	36
PID 2336 wrote to memory of 1516	2336	svchost.exe	36
PID 2336 wrote to memory of 3012	2336	svchost.exe	38
PID 2336 wrote to memory of 3012	2336	svchost.exe	38
PID 2336 wrote to memory of 3012	2336	svchost.exe	38
PID 2336 wrote to memory of 3012	2336	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe
"C:\Users\Admin\AppData\Local\Temp\76cb3bce2565ad3330d129ed9de878d61eeca00b18143738b857557b09bc679b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:276
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1516
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
4317f222d5687c4da213ab686fc8d701

SHA1
e4d58d207f5cd73ef8a87c1854a2cea4e75fa709

SHA256
b832556a95ba9e4c66f88bfa7a24759e7b876d5e82566d31618fbb3743e22cec

SHA512
75ca2377c156c5f3f21069fc167158fe9fdb69348db920d2aa5135c06ec8f16e8693277d1d0b9ab277e2757ab853cbc27dc09389764c535c685f6162116a1055

Download Submit
C:\Windows\system\svchost.exe

Filesize
66KB

MD5
27dfb66071f5fe799832bcb3497bd9c7

SHA1
6e78c65d862e74f04a3d622f8545fc9e1d7c36e3

SHA256
33fdb7330342d3036aa824a31f7188c7115ebd349f6934ff3195310852d57696

SHA512
416674fcda7c6e5e56965cfcddc086a9bb8e1601c11cde755db5726cfe0b563249ac5a4b70109dd6b869b86a89f3c2a1d6ef5f3d548c31a9dd9f770b2e1b61e3

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
6be0173446eb6eeac4a9cb0cb6f1248e

SHA1
ed000887e197de77c20319c4211b0003a30d64c4

SHA256
3ea52a236d07e892bdf5eec6a9079c51ec87d4ca356edf44b9aabf07948d1211

SHA512
d90e1725407fbdbbfa238ed58fcc1597f628ae3054cea29c04404236ec139ec05f31aae99f6750c956fdf9be0bf5586c141fff4b8c5ae38afc7dc3558dfde700

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
4ca830b2dc75e0b62b29d75def8c3a43

SHA1
e67d7dd808cd41cff3a4c60ce183a9eb5cc9d42f

SHA256
52b27a7603dc3460afd6b0c6137069359900d0df9373467733067e2f1b5feb8a

SHA512
ad1bc8bc3e161fa57f4b6baa6e6e1883c0752991773a636e3dd141b6a07a04107aa71c683fdff3f0c32e3f1680830da69760d4c533fad62daf9cb04fe0a8b976

Download Submit
memory/2068-78-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2068-54-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2068-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2068-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2068-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2068-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2068-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2068-59-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2068-16-0x0000000002750000-0x0000000002781000-memory.dmp

Filesize
196KB

Download
memory/2068-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2336-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2336-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2336-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2464-66-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2464-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2464-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2700-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2700-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2700-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2700-53-0x00000000026B0000-0x00000000026E1000-memory.dmp

Filesize
196KB

Download
memory/2732-35-0x0000000003030000-0x0000000003061000-memory.dmp

Filesize
196KB

Download
memory/2732-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2732-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2732-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2732-34-0x0000000003030000-0x0000000003061000-memory.dmp

Filesize
196KB

Download
memory/2732-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2732-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download