Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 02:03

General

  • Target

    a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe

  • Size

    65KB

  • MD5

    c53fa85582f85ce804c246badb499ea4

  • SHA1

    4760927447e6acc5c6cc77d58ef68a3a11f4ba86

  • SHA256

    a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa

  • SHA512

    e09af3fd843e3d621efff48e3b824bad2678024fc4deb4cc022d55b527b6028294f48e7f4e6f0cd87756631a444037d855db2f562e4ab1735a1f83ef4a01e394

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou1:7WNqkOJWmo1HpM0MkTUmu1

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe
    "C:\Users\Admin\AppData\Local\Temp\a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2180
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2912
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2584
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2708
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2496
          • C:\Windows\SysWOW64\at.exe
            at 02:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2888
            • C:\Windows\SysWOW64\at.exe
              at 02:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2872
              • C:\Windows\SysWOW64\at.exe
                at 02:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:3032

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          65KB

          MD5

          38bcc36708d37b18f663ab913f1a1513

          SHA1

          65877c9c6054baff9d5f2526c874a64563aea1d0

          SHA256

          c549a990d2ae4dedd502630228eb3c4ac686baa691b9651b71061a6fcb59d206

          SHA512

          f05b6f5d923246b50c9fd77b4fe2c421f7707a3fa7a19f79866eacd6b539f4960382f1d06944b1a3a3fd888ef2cd5b00de2b52f97898e81050264bcf79ad9a5e

        • \Windows\system\explorer.exe

          Filesize

          65KB

          MD5

          dcab432f3492b1156f84044fbca06543

          SHA1

          16a23a23dc12e070ef757eddb6eb27b7e9eddf42

          SHA256

          f4fe6f0f95c9687d9a1907e595324290deebf24532dda88b9b90f4d6fd6fd2cc

          SHA512

          075ae8bd738e0c3873e38c2eb90dcfa37b566db5495b0bab1c3a50ee89ee3e57465fa94507e25c12d0eb37b3ad0d884cd8e79d94c98483298d4f8b9a86d450a0

        • \Windows\system\spoolsv.exe

          Filesize

          65KB

          MD5

          ec0ccef008996062226f8904f44e9f4b

          SHA1

          ad0d3e5673321c23e51de38fa95edd67460618b0

          SHA256

          cbf4b45ee62c383f9c51dd1a0fe5d40828ef3e3487175f34f51eb5e60ef3daaa

          SHA512

          c63fb3cf6b9eb2809da5770964a5176e21ff70af652a81f0f6162bd8a850df9a7aa23c5fc2472cc768232b107f7889980004150731abd715329350193135bf36

        • \Windows\system\svchost.exe

          Filesize

          65KB

          MD5

          31a000085e08abafbbb5c12413be0517

          SHA1

          f7db5b46983de5da14d84801952dd97eeeda3f91

          SHA256

          622857b77cb6a465bd86a2f336f03cdabeda2cf0b15a0ddc54a38667017d6a4d

          SHA512

          bdc26532227b4da15cbe5c92728f32f34a8550a030004f5ccf0431b58b86e276d8d471f646f946a4debe959d3af2402e955ea7ec9a32194a7c5fbba8508e47da

        • memory/2180-77-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2180-2-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2180-13-0x0000000002810000-0x0000000002841000-memory.dmp

          Filesize

          196KB

        • memory/2180-1-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2180-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2180-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2180-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2180-76-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2496-72-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2496-64-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2584-35-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2584-40-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2584-36-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2584-52-0x00000000028B0000-0x00000000028E1000-memory.dmp

          Filesize

          196KB

        • memory/2584-74-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2708-81-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2708-53-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2708-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2708-63-0x0000000002440000-0x0000000002471000-memory.dmp

          Filesize

          196KB

        • memory/2912-34-0x0000000003140000-0x0000000003171000-memory.dmp

          Filesize

          196KB

        • memory/2912-20-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2912-79-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2912-18-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2912-90-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB