8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853

Analysis

max time kernel
150s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe
Size 65KB
Sample240614-blppsashqn
SHA256 8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853
MD5 f33fa2d23e775ac36956d4969469c13d
SHA1 36258d065505907be1ff630b0af04f011f22a1ea
SHA512 754934b97dc86c3717e15272983b269736e8538b8f76c2913c5e04c211f8cc65da84d8efd8384f9270bb442d159d0826be92f44e714baccd3c9081d07b316c46
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouj:7WNqkOJWmo1HpM0MkTUmuj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1376	explorer.exe
4152	spoolsv.exe
2852	svchost.exe
2432	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe
2928	8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
2852	svchost.exe
1376	explorer.exe
2852	svchost.exe
1376	explorer.exe
2852	svchost.exe
1376	explorer.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
1376	explorer.exe
1376	explorer.exe
2852	svchost.exe
2852	svchost.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
2852	svchost.exe
1376	explorer.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
2852	svchost.exe
1376	explorer.exe
2852	svchost.exe
1376	explorer.exe
2852	svchost.exe
1376	explorer.exe
2852	svchost.exe
2852	svchost.exe
1376	explorer.exe
2852	svchost.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1376	explorer.exe
2852	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2928	8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe
2928	8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe
1376	explorer.exe
1376	explorer.exe
4152	spoolsv.exe
4152	spoolsv.exe
2852	svchost.exe
2852	svchost.exe
2432	spoolsv.exe
2432	spoolsv.exe
1376	explorer.exe
1376	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1376	2928	8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe	82
PID 2928 wrote to memory of 1376	2928	8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe	82
PID 2928 wrote to memory of 1376	2928	8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe	82
PID 1376 wrote to memory of 4152	1376	explorer.exe	84
PID 1376 wrote to memory of 4152	1376	explorer.exe	84
PID 1376 wrote to memory of 4152	1376	explorer.exe	84
PID 4152 wrote to memory of 2852	4152	spoolsv.exe	85
PID 4152 wrote to memory of 2852	4152	spoolsv.exe	85
PID 4152 wrote to memory of 2852	4152	spoolsv.exe	85
PID 2852 wrote to memory of 2432	2852	svchost.exe	87
PID 2852 wrote to memory of 2432	2852	svchost.exe	87
PID 2852 wrote to memory of 2432	2852	svchost.exe	87
PID 2852 wrote to memory of 4984	2852	svchost.exe	88
PID 2852 wrote to memory of 4984	2852	svchost.exe	88
PID 2852 wrote to memory of 4984	2852	svchost.exe	88
PID 2852 wrote to memory of 4116	2852	svchost.exe	98
PID 2852 wrote to memory of 4116	2852	svchost.exe	98
PID 2852 wrote to memory of 4116	2852	svchost.exe	98
PID 2852 wrote to memory of 2940	2852	svchost.exe	100
PID 2852 wrote to memory of 2940	2852	svchost.exe	100
PID 2852 wrote to memory of 2940	2852	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe
"C:\Users\Admin\AppData\Local\Temp\8de80922539fcebaef24bc9c706aa827a992b651c79857fe0675968f79376853.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1376
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4984
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:17 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4116
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 d48f93c0e44edf08d95a4af718e68c6cfbf2f706ecdfa094f46548a74df5a22b
MD5 1db4ce80b2bc41155785ce1d12755024
SHA1 057430365f365b7f7d0d3769ab1810c3ae83bedb
SHA512 c69f79ffab5b62db2a2e4054181c62196ccdf5d8f9b2ac6d97e3d06cb6489291303a3f2688c08d9e39ba78604101539e44d0bc3fb592393044cb1973aded1d9f
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuZ:7WNqkOJWmo1HpM0MkTUmuZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 e99bb2059de9aa374cda3d2ff6d1d28dcc8db6ae3b6c6ce5f35bbc4dc6c57fa3
MD5 516892a0959528483e4bdb81e0eb08e5
SHA1 e6ea1473dd9560a2c26c1b00a1033aa88b3f9583
SHA512 9831b4dec49b393b1811252c775b04ebb539d0f0305d1a55eceec495a996eb963c1d3dca2a067f4445fa610c0acee1ec0ca84c3771b6aacbc25504f8ee2435cd
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou3FFFFFFFFFFFFFFFFFFF:7WNqkOJWmo1HpM0MkTUmu9
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 4ffba91e9a6d37c10bf2eee307893d260e39a3224187d801b188aa4fa2f7aa5e
MD5 ee2cc4e9611175540d91ce2fcedd9d04
SHA1 ee1779572cf844e42e7a5319bee8d84af4962d91
SHA512 c7cdcec985fba8395a12576e328ad1819f418e41b82d52a7d0600899407f8733bfaee0c8abd8941d0429ad922ec3435fe70f19cafe6f1e550a4a81657218fd06
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuJ:7WNqkOJWmo1HpM0MkTUmuJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 c9c76fb33b21e7e119878765e20db327f10020f48caee615f922d36d3eb3c965
MD5 13e770fa0e57a7e36696c364f25a8c40
SHA1 24d8e8e0598614b47164c82ca4fc613103927f3f
SHA512 bb41abed50d2466946799875ac7965773f929ec66f21d98d8e341f55751f93eb8da7ab9944eea165ac47e129efcc861b5a70f08e8a6b99fcd4cc1818c5d0825f
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou9:7WNqkOJWmo1HpM0MkTUmu9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1376-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1376-12-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1376-14-0x0000000075760000-0x00000000758BD000-memory.dmp

Download

memory/1376-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1376-68-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2432-49-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2432-43-0x0000000075760000-0x00000000758BD000-memory.dmp

Download

memory/2852-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2852-37-0x0000000075760000-0x00000000758BD000-memory.dmp

Download

memory/2928-56-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2928-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/2928-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2928-5-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2928-2-0x0000000075760000-0x00000000758BD000-memory.dmp

Download

memory/2928-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2928-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4152-30-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4152-26-0x0000000075760000-0x00000000758BD000-memory.dmp

Download

memory/4152-25-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4152-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download