a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe
Size 65KB
Sample240614-cg4hta1eqb
SHA256 a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa
MD5 c53fa85582f85ce804c246badb499ea4
SHA1 4760927447e6acc5c6cc77d58ef68a3a11f4ba86
SHA512 e09af3fd843e3d621efff48e3b824bad2678024fc4deb4cc022d55b527b6028294f48e7f4e6f0cd87756631a444037d855db2f562e4ab1735a1f83ef4a01e394
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou1:7WNqkOJWmo1HpM0MkTUmu1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2916	explorer.exe
3636	spoolsv.exe
2060	svchost.exe
5088	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
760	a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe
760	a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe
2916	explorer.exe
2916	explorer.exe
2060	svchost.exe
2060	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2916	explorer.exe
2060	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
760	a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe
760	a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe
2916	explorer.exe
2916	explorer.exe
3636	spoolsv.exe
3636	spoolsv.exe
2060	svchost.exe
2060	svchost.exe
5088	spoolsv.exe
5088	spoolsv.exe
2916	explorer.exe
2916	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2916	760	a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe	83
PID 760 wrote to memory of 2916	760	a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe	83
PID 760 wrote to memory of 2916	760	a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe	83
PID 2916 wrote to memory of 3636	2916	explorer.exe	84
PID 2916 wrote to memory of 3636	2916	explorer.exe	84
PID 2916 wrote to memory of 3636	2916	explorer.exe	84
PID 3636 wrote to memory of 2060	3636	spoolsv.exe	85
PID 3636 wrote to memory of 2060	3636	spoolsv.exe	85
PID 3636 wrote to memory of 2060	3636	spoolsv.exe	85
PID 2060 wrote to memory of 5088	2060	svchost.exe	87
PID 2060 wrote to memory of 5088	2060	svchost.exe	87
PID 2060 wrote to memory of 5088	2060	svchost.exe	87
PID 2060 wrote to memory of 2356	2060	svchost.exe	88
PID 2060 wrote to memory of 2356	2060	svchost.exe	88
PID 2060 wrote to memory of 2356	2060	svchost.exe	88
PID 2060 wrote to memory of 3056	2060	svchost.exe	94
PID 2060 wrote to memory of 3056	2060	svchost.exe	94
PID 2060 wrote to memory of 3056	2060	svchost.exe	94
PID 2060 wrote to memory of 3928	2060	svchost.exe	96
PID 2060 wrote to memory of 3928	2060	svchost.exe	96
PID 2060 wrote to memory of 3928	2060	svchost.exe	96

C:\Users\Admin\AppData\Local\Temp\a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe
"C:\Users\Admin\AppData\Local\Temp\a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5088
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2356
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3056
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 48a0e0aba059532b24256672f3f7d9ddb3ff3272e905dedcc19b81d86e88f899
MD5 5bd6fc5307542083818d481b6c34bf6d
SHA1 3a27084eaf88119de944231d30b5ce98f10f3c42
SHA512 985d34b2d26f102e886aa52c4075329760fecdfa25e69253a3a2f1a3c148a146835de750f13c54873bc172cc103bbbdf8fc110d0a642f58e582cb730d92444ae
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oui:7WNqkOJWmo1HpM0MkTUmui
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 a34a75af886e2c0d70d969692a53d7e70a7d0418c2163cc293b6f563feb6dcab
MD5 d197c11203794adc0d132fa6282bf908
SHA1 dc70723a4119165aca63dfe65422b79175ea2c11
SHA512 e12dfd77e2010e2994c714d580eee4368770f19cbe75ebe314e600ff2537dbd2a5e3ae692e9925cf0657a461e50ca786744022ab7fd04b710e63e7444108157b
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuB:7WNqkOJWmo1HpM0MkTUmuB
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 d6e21b12415a4d314e1b83bef21dabc848a928674eaf995267e5a62774584fee
MD5 816cdcc3720ee48da8f1f6e261cd9665
SHA1 b1d4cc0bb9b6909986c51cff8b0709180b329492
SHA512 5bfd916266d5d650ef17ada31ab379ca909078b5599b0c5aba2a8ca08fa84045c6b2ab342b46ab28cd2b755134aa522a583a811201cbb85b2b5eb7f7429e4dd2
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OupllllllllllllllllllU:7WNqkOJWmo1HpM0MkTUmuplllllllllC
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 28b135c7739f0a67c5f02cc828d9ab8b428f4e037c2a0aa3d71d96f5a51d2a94
MD5 5f963ee6e49d6c01ad1435169b61c7f6
SHA1 e34486a554ea58031e0e59c0a2bacdaef199652d
SHA512 3352f7128e096f83ddb141e22b165c85f7a4a2f14e5cb9af8017d13c2fc2dd5f2fdf8b873551b4049830f84dc9a5d54b79a296978d42d0a8796e1b8de28d962d
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oux:7WNqkOJWmo1HpM0MkTUmux
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/760-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/760-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/760-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/760-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/760-2-0x0000000074D50000-0x0000000074EAD000-memory.dmp

Download

memory/760-57-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/760-58-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/760-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2060-35-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2060-36-0x0000000074D50000-0x0000000074EAD000-memory.dmp

Download

memory/2060-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2060-61-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2916-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2916-14-0x0000000074D50000-0x0000000074EAD000-memory.dmp

Download

memory/2916-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2916-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2916-70-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3636-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3636-25-0x0000000074D50000-0x0000000074EAD000-memory.dmp

Download

memory/5088-43-0x0000000074D50000-0x0000000074EAD000-memory.dmp

Download

memory/5088-51-0x0000000000400000-0x0000000000431000-memory.dmp

Download