8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4

Analysis

max time kernel
150s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe
Size 65KB
Sample240614-bgyrwssfpr
SHA256 8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4
MD5 732ea3bd36e71b12a221633df5ffc37d
SHA1 4ea796c56d3a61faaf5bf97f0c03bbd5859829e1
SHA512 f27c7fbdd5bb78488400bd55d70a00be6ad46ac30d1d3f51456f593190e01ae565f044512392c528d8338d8a82c691d35405a785d1be772ae14359601138b8c8
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuM:7WNqkOJWmo1HpM0MkTUmuM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3872	explorer.exe
4708	spoolsv.exe
4316	svchost.exe
3980	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1868	8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe
1868	8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
4316	svchost.exe
4316	svchost.exe
4316	svchost.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
4316	svchost.exe
3872	explorer.exe
3872	explorer.exe
4316	svchost.exe
4316	svchost.exe
4316	svchost.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
4316	svchost.exe
3872	explorer.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
4316	svchost.exe
3872	explorer.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
3872	explorer.exe
4316	svchost.exe
4316	svchost.exe
4316	svchost.exe
3872	explorer.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
3872	explorer.exe
4316	svchost.exe
4316	svchost.exe
3872	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3872	explorer.exe
4316	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1868	8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe
1868	8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe
3872	explorer.exe
3872	explorer.exe
4708	spoolsv.exe
4708	spoolsv.exe
4316	svchost.exe
4316	svchost.exe
3980	spoolsv.exe
3980	spoolsv.exe
3872	explorer.exe
3872	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3872	1868	8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe	81
PID 1868 wrote to memory of 3872	1868	8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe	81
PID 1868 wrote to memory of 3872	1868	8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe	81
PID 3872 wrote to memory of 4708	3872	explorer.exe	82
PID 3872 wrote to memory of 4708	3872	explorer.exe	82
PID 3872 wrote to memory of 4708	3872	explorer.exe	82
PID 4708 wrote to memory of 4316	4708	spoolsv.exe	84
PID 4708 wrote to memory of 4316	4708	spoolsv.exe	84
PID 4708 wrote to memory of 4316	4708	spoolsv.exe	84
PID 4316 wrote to memory of 3980	4316	svchost.exe	85
PID 4316 wrote to memory of 3980	4316	svchost.exe	85
PID 4316 wrote to memory of 3980	4316	svchost.exe	85
PID 4316 wrote to memory of 628	4316	svchost.exe	87
PID 4316 wrote to memory of 628	4316	svchost.exe	87
PID 4316 wrote to memory of 628	4316	svchost.exe	87
PID 4316 wrote to memory of 3436	4316	svchost.exe	98
PID 4316 wrote to memory of 3436	4316	svchost.exe	98
PID 4316 wrote to memory of 3436	4316	svchost.exe	98
PID 4316 wrote to memory of 2960	4316	svchost.exe	100
PID 4316 wrote to memory of 2960	4316	svchost.exe	100
PID 4316 wrote to memory of 2960	4316	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe
"C:\Users\Admin\AppData\Local\Temp\8b2bc3f2620cfd06281d207ec363ab2930a245944b758912644ea6a9a76107e4.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3872
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3980
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:628
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3436
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 4b8cae151d33bb9ed6fd865676a789f6cd4138e765b716bdc2c7c76e2624e51e
MD5 4f21c5ca37d03f1acfb05b73fbf686f3
SHA1 67caa920ac7103bb43f46b88ef5abccc89232da0
SHA512 deab85a177bb529c85c4602e3373afba6eebbd9575c501e39a056310b77e6c01242925d192d0ee35581c33aa3005031d2f6d4a4fc2923c1c43de47931a48c7d5
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuC:7WNqkOJWmo1HpM0MkTUmuC
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 1dfd409da73c6e01c28d7b1d2137da785c0d9fc1107cc7158946e9660a620abb
MD5 faf4db506eace314cbf945ff30e0e836
SHA1 015f4f53661a5dbe6d80d0aaacd70b8892355664
SHA512 dd75c0989c5adf37c68a8839b8b5a53830f88cf96cfdae6f3a05b789d58ba1d3d3bad38f16d606600fa8b8707c220d514a7d014e2212965adede21975b5cfb20
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuY:7WNqkOJWmo1HpM0MkTUmuY
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 cc72617d6e3df6fdf00730b156f78127a2ebdaa1a4d88ad49ff05bae0c8897e7
MD5 b4b07e4f25b3f9410aeea77d75911404
SHA1 55e32173d1d17a0aa5618ad50665be451d9ed79c
SHA512 89ba994f6db2375d3a1d0e9622e526dc293e1404aa2843cd57045303eac6a3a4e6847cc017c9e7a83b85b3f4138b1999c81325256dd47cf3ab3d19ccdb1a8171
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouc:7WNqkOJWmo1HpM0MkTUmuc
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 355c548e6403836929f49067dff17d8c382bf9fae4f92c6ebf61ff1b0fcd4ca8
MD5 35003b13ff431eb115b28ec61db3d25e
SHA1 a3c33773f7be288efd89952d1b5e909229c6f4cd
SHA512 9378c5fb486448d3ef529a1b52e167e6bf5d503dabce1b486b68ff599448e87b20d2d60e351c171c1b5e7a5ce5e39574fd4e2a8c9e35325c4d0efe2a698691c3
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou3:7WNqkOJWmo1HpM0MkTUmu3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1868-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1868-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1868-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/1868-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1868-55-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1868-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1868-2-0x0000000074FA0000-0x00000000750FD000-memory.dmp

Download

memory/3872-68-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3872-17-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3872-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3872-13-0x0000000074FA0000-0x00000000750FD000-memory.dmp

Download

memory/3872-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3980-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3980-42-0x0000000074FA0000-0x00000000750FD000-memory.dmp

Download

memory/3980-48-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4316-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4316-35-0x0000000074FA0000-0x00000000750FD000-memory.dmp

Download

memory/4708-25-0x0000000074FA0000-0x00000000750FD000-memory.dmp

Download

memory/4708-52-0x0000000000400000-0x0000000000431000-memory.dmp

Download