Malware Analysis Report

2024-11-16 10:53

Sample ID 240614-b69wfsvapj
Target 9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063
SHA256 9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063

Threat Level: Known bad

The file 9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063 was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies WinLogon for persistence

Modifies visiblity of hidden/system files in Explorer

Modifies Installed Components in the registry

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 01:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 01:46

Reported

2024-06-14 01:49

Platform

win7-20231129-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2900 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe \??\c:\windows\system\explorer.exe
PID 2900 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe \??\c:\windows\system\explorer.exe
PID 2900 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe \??\c:\windows\system\explorer.exe
PID 2900 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe \??\c:\windows\system\explorer.exe
PID 3012 wrote to memory of 2692 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3012 wrote to memory of 2692 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3012 wrote to memory of 2692 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3012 wrote to memory of 2692 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2692 wrote to memory of 2592 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2692 wrote to memory of 2592 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2692 wrote to memory of 2592 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2692 wrote to memory of 2592 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2592 wrote to memory of 2728 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2592 wrote to memory of 2728 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2592 wrote to memory of 2728 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2592 wrote to memory of 2728 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2592 wrote to memory of 2920 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 2920 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 2920 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 2920 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 1772 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 1772 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 1772 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 1772 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 1056 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 1056 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 1056 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2592 wrote to memory of 1056 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe

"C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 01:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 01:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 01:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

N/A

Files

memory/2900-1-0x0000000000020000-0x0000000000024000-memory.dmp

memory/2900-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2900-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2900-2-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2900-4-0x0000000000401000-0x000000000042E000-memory.dmp

\Windows\system\explorer.exe

MD5 9ce2f227cc21d1f4d45c282600526bf7
SHA1 033d5deeb375a246974d02e2f9850c189cced97f
SHA256 0f03f295df718352564716251c74449443670816f5a408162d191a1b42c7b681
SHA512 ae29f131ca58572e1c5078d43a3980af88e56210ef4c911cef69b81517787497614ffda0b5745ed42ccb13b8fd083bd7f10d8c6d6688cb12924cf8a0e73ef6b6

memory/2900-13-0x0000000003140000-0x0000000003171000-memory.dmp

memory/2900-17-0x0000000003140000-0x0000000003171000-memory.dmp

memory/3012-19-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/3012-23-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\spoolsv.exe

MD5 58253f2c8c30c9e986eb83d4435fce7d
SHA1 e7a98c4e7a239c48c242ce42ab15825202441186
SHA256 ad8f7885290600c8d096a91f73571e009234c30c62cfac4ca045b39658d3b807
SHA512 594d0e1aab19e3b14495f0b617a014347aac2c0b4eeb3dfc692ab1832362a770d944716549f967cee126b333c395a5d03b27b56c0b9df433e9cf360f85311881

memory/3012-36-0x0000000002720000-0x0000000002751000-memory.dmp

memory/3012-35-0x0000000002720000-0x0000000002751000-memory.dmp

memory/2692-37-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2692-41-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\svchost.exe

MD5 d401eb5b0d2219381031099b562af6c5
SHA1 9046e5fc6bffbdf2901e3ae8e2073116c6962e70
SHA256 b5ea141b7b84142d7278dddd09f6d6264e709e396f7212f6ab9e74c95ad080ae
SHA512 73053061b0a22baa79dfaffcd6bab1a166633b858faaff75191f1922cb075dc1eb137ffde0f11e5262d6aa4ee7a7a8ac4e6a4639c74d53ded1a3c26a829bff81

memory/2900-54-0x0000000000020000-0x0000000000024000-memory.dmp

memory/2692-53-0x0000000001DE0000-0x0000000001E11000-memory.dmp

memory/2900-58-0x0000000000401000-0x000000000042E000-memory.dmp

memory/2592-60-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2592-55-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2592-66-0x0000000000530000-0x0000000000561000-memory.dmp

memory/2728-67-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2728-73-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2692-76-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2900-77-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2900-78-0x0000000000401000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 0ff5cfe7639a24c908b3a6aa7369f8ff
SHA1 37294baf51728551e2e755ed80dfe8b541df390a
SHA256 ef75e4c00eb85c9c29ad67760ae054da5886a189d96a675420ff40ab52dd75b4
SHA512 0136d000fd4e4223c8b235c7f4737615ef8fe9617c87e0a455d225d23c139eb585aea5f8d83114612a10d0248cf0248015aedd52c0adc9676152b2aaec936c14

memory/3012-80-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3012-81-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2592-82-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3012-91-0x0000000000400000-0x0000000000431000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 01:46

Reported

2024-06-14 01:49

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1948 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe \??\c:\windows\system\explorer.exe
PID 1948 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe \??\c:\windows\system\explorer.exe
PID 1948 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe \??\c:\windows\system\explorer.exe
PID 4136 wrote to memory of 2112 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4136 wrote to memory of 2112 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4136 wrote to memory of 2112 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2112 wrote to memory of 5004 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2112 wrote to memory of 5004 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2112 wrote to memory of 5004 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 5004 wrote to memory of 2504 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 5004 wrote to memory of 2504 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 5004 wrote to memory of 2504 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 5004 wrote to memory of 5112 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5004 wrote to memory of 5112 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5004 wrote to memory of 5112 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5004 wrote to memory of 3972 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5004 wrote to memory of 3972 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5004 wrote to memory of 3972 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5004 wrote to memory of 1980 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5004 wrote to memory of 1980 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5004 wrote to memory of 1980 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe

"C:\Users\Admin\AppData\Local\Temp\9a8aa5659f20f74fe41ea53d9d49993ace70342a0f5dfc5c6bc15ff14789f063.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 01:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,8447163055677043976,7218082390179600880,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8

C:\Windows\SysWOW64\at.exe

at 01:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 01:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 13.107.42.16:443 tcp
US 8.8.8.8:53 89.43.201.23.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.43.201.23.in-addr.arpa udp

Files

memory/1948-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

memory/1948-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1948-2-0x00000000756E0000-0x000000007583D000-memory.dmp

memory/1948-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1948-4-0x0000000000401000-0x000000000042E000-memory.dmp

C:\Windows\System\explorer.exe

MD5 60836693d32a61289cad6df7cb941ce4
SHA1 a8d5dead780939d2561d24247af54aa7d2993ab9
SHA256 8cfa13b32e2d5c3f7ce8320819f428dd41ceb9b465f3a5b859fca08100ec8bfe
SHA512 4fb1d8d6b970a43bc55674ad5caf382f22dd5273d51ae9f77212ecd6526fc63a22b38fe520c77fd36e0a3b0686eecbbf0799694577d7d5b0010be3b9cc52502f

memory/4136-15-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4136-13-0x00000000756E0000-0x000000007583D000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 c3b232e4363f06f8a57b8ee2d423702d
SHA1 e73ce63cbf992d1f44353a2bb85412a402896b40
SHA256 808a555ce15ecbd2e1d4ede51cb068ccf8ca102957b076d26e676cde2a29f608
SHA512 6203b8f109af302924db3c021d2a93754467f6730384529c66f5eca793dd0c3410d5e1881f68d5427bbaea3c80850fba9baf314669b8cd19a9548800e1ac655a

memory/2112-24-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2112-25-0x00000000756E0000-0x000000007583D000-memory.dmp

C:\Windows\System\svchost.exe

MD5 7f2cb0c56e49b855912a5ebdf198e808
SHA1 e7b4813cc964246249523533bcd7c7c56f9c5a5e
SHA256 2e6a412a07c8ee8a38be97f05291b43b9107c8d330adf3f9278e633cd1445182
SHA512 8dd839c1610cc2f23efe0ff362340d5b46c133a8506071401075ec32bfb91fa28bb9e1053ec9993d6f2fa2c90bbc68b64292c650e5943437a33b395c4d5f2134

memory/5004-35-0x0000000000400000-0x0000000000431000-memory.dmp

memory/5004-36-0x00000000756E0000-0x000000007583D000-memory.dmp

memory/5004-41-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2504-43-0x00000000756E0000-0x000000007583D000-memory.dmp

memory/2504-49-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1948-55-0x00000000001C0000-0x00000000001C4000-memory.dmp

memory/2112-57-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1948-56-0x0000000000401000-0x000000000042E000-memory.dmp

memory/1948-54-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 a0ef75f72c7e4560a47b7a4c25a3acf6
SHA1 0c1cd9b48ca94af0bce668fa7bb788677900b75c
SHA256 97296c1868235b8abcb60437dfe4923a4a8021c3341c34b80e0a89e0bb0d5c23
SHA512 281f1af65969bb3b150b4e1d0043977f7ef504bff4ff0c85a64aa78bf6b1aa9ca2f2e9f6993981c2779ce0dabf14097c188a0b67c90b398c957da7b7b6764fb8

memory/4136-59-0x0000000000400000-0x0000000000431000-memory.dmp

memory/5004-61-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4136-70-0x0000000000400000-0x0000000000431000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e