Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe
Resource
win7-20240611-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe
- Size 206KB
- Sample240614-bhsbhasgll
- SHA256 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593
- MD5 1e8591b6b74c32c98a8a42ed15b2ffa8
- SHA1 3eeba70f26637e12555ac8489df81a83e48ddc39
- SHA512 b103391b69b05058bba153ce8fe1cd3acf24f94aa259e74d2e3cbe4699035fb60628359caa748bbe687df8a5b277aed2d8be768881a7451ae7371593959d2341
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unw:zvEN2U+T6i5LirrllHy4HUcMQY6D
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe - Executes dropped EXE 4 IoCs
pid Process 2900 explorer.exe 4900 spoolsv.exe 868 svchost.exe 3092 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4660 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe 4660 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe 2900 explorer.exe 2900 explorer.exe 2900 explorer.exe 2900 explorer.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe 2900 explorer.exe 2900 explorer.exe 868 svchost.exe 868 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2900 explorer.exe 868 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4660 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe 4660 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe 2900 explorer.exe 2900 explorer.exe 4900 spoolsv.exe 4900 spoolsv.exe 868 svchost.exe 868 svchost.exe 3092 spoolsv.exe 3092 spoolsv.exe 2900 explorer.exe 2900 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4660 wrote to memory of 2900 4660 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe 82 PID 4660 wrote to memory of 2900 4660 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe 82 PID 4660 wrote to memory of 2900 4660 8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe 82 PID 2900 wrote to memory of 4900 2900 explorer.exe 83 PID 2900 wrote to memory of 4900 2900 explorer.exe 83 PID 2900 wrote to memory of 4900 2900 explorer.exe 83 PID 4900 wrote to memory of 868 4900 spoolsv.exe 85 PID 4900 wrote to memory of 868 4900 spoolsv.exe 85 PID 4900 wrote to memory of 868 4900 spoolsv.exe 85 PID 868 wrote to memory of 3092 868 svchost.exe 86 PID 868 wrote to memory of 3092 868 svchost.exe 86 PID 868 wrote to memory of 3092 868 svchost.exe 86 PID 868 wrote to memory of 3004 868 svchost.exe 87 PID 868 wrote to memory of 3004 868 svchost.exe 87 PID 868 wrote to memory of 3004 868 svchost.exe 87 PID 868 wrote to memory of 3656 868 svchost.exe 99 PID 868 wrote to memory of 3656 868 svchost.exe 99 PID 868 wrote to memory of 3656 868 svchost.exe 99 PID 868 wrote to memory of 2812 868 svchost.exe 101 PID 868 wrote to memory of 2812 868 svchost.exe 101 PID 868 wrote to memory of 2812 868 svchost.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe"C:\Users\Admin\AppData\Local\Temp\8bc8e0bafcdb9c65d2ac63bbeaae9ca7d2d4527b73d1680ddd3deb84e6e66593.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3092
-
-
C:\Windows\SysWOW64\at.exeat 01:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3004
-
-
C:\Windows\SysWOW64\at.exeat 01:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3656
-
-
C:\Windows\SysWOW64\at.exeat 01:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2812
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 207KB
- SHA256 ad774f7fcf261f6100adaa4ca2f2a7395b0ded7a1d01adc5de789a723113713a
- MD5 05c0acd1deb17455562cdf4b098b4367
- SHA1 1f053690aa45b57625b5b51cf8988d31cbf5d002
- SHA512 b91e5872fc2973a89d6e501aff584b2a1ae451538495cfee1d6e309e09447a048e826d3c84483ab910501849a0a146f7364f5bcb824718da991b3a50a970cb0a
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unZ:zvEN2U+T6i5LirrllHy4HUcMQY62
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 1a53b77170f88d1585826726681f4f3966172b1eb1f13391a63642187e64ffb6
- MD5 b35534b32c3dab67eee5f05d35254fde
- SHA1 40509831d3933761b635036a7b7c1d1ea4dbb527
- SHA512 008d5203627eab1f8f86086af5159a3391d58ad90bc34716776fe837736629ac0c39e807575a9d8ec72d568e53e8b7dc53ed8826dc94434c5bdd74bf6df8111b
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unE:zvEN2U+T6i5LirrllHy4HUcMQY6L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 6d88eb0dbfb437b50ae9543f935f939a38d66ed8bec18f761a37225f0fda7960
- MD5 47db259b67848e97b45acac4e6bf4264
- SHA1 7629b77fce8a76e18e4933119e90964e0e7cd02e
- SHA512 9cf5f6231468318bf81c05fbbad034bfd6ac8e4bbe6751ff449c2aa04ac7af9832d5f129d6b18fb6e68175b2ec00f15c8f89a98f01c30ca1a332faaac0b7d9dd
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unq:zvEN2U+T6i5LirrllHy4HUcMQY6f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 ffd5477812a01333942c7d133403ab908f1fd2b22310fa14791dfb148853a519
- MD5 1381c93d8e217c0d26004027af0c89b8
- SHA1 3e275484c3f42755473867472dff8322e5eefb41
- SHA512 85efc39dc8c1f6eff65cf5d4dbac77c7259becea46132758de10a19c05aa561d6d3c742c73eb65ea214d4910dc0e479c7cb0549c837ef926f33c4de9a01a6464
- SSDEEP 6144:zvEN2U+T6i5LirrllHy4HUcMQY6k///////////////////////////////////P:zENN+T5xYrllrU7QY6k////////////H
- MD5 SHA1 SHA512 SSDEEP