Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 02:03

General

  • Target

    a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe

  • Size

    65KB

  • MD5

    c53fa85582f85ce804c246badb499ea4

  • SHA1

    4760927447e6acc5c6cc77d58ef68a3a11f4ba86

  • SHA256

    a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa

  • SHA512

    e09af3fd843e3d621efff48e3b824bad2678024fc4deb4cc022d55b527b6028294f48e7f4e6f0cd87756631a444037d855db2f562e4ab1735a1f83ef4a01e394

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou1:7WNqkOJWmo1HpM0MkTUmu1

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe
    "C:\Users\Admin\AppData\Local\Temp\a2359cf95b1baec0f57a0d410d76ff235c08acab2d001cdfc4d52a95e77e68aa.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:760
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2916
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3636
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2060
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:5088
          • C:\Windows\SysWOW64\at.exe
            at 02:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2356
            • C:\Windows\SysWOW64\at.exe
              at 02:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:3056
              • C:\Windows\SysWOW64\at.exe
                at 02:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:3928

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          65KB

          MD5

          5bd6fc5307542083818d481b6c34bf6d

          SHA1

          3a27084eaf88119de944231d30b5ce98f10f3c42

          SHA256

          48a0e0aba059532b24256672f3f7d9ddb3ff3272e905dedcc19b81d86e88f899

          SHA512

          985d34b2d26f102e886aa52c4075329760fecdfa25e69253a3a2f1a3c148a146835de750f13c54873bc172cc103bbbdf8fc110d0a642f58e582cb730d92444ae

        • C:\Windows\System\explorer.exe

          Filesize

          65KB

          MD5

          d197c11203794adc0d132fa6282bf908

          SHA1

          dc70723a4119165aca63dfe65422b79175ea2c11

          SHA256

          a34a75af886e2c0d70d969692a53d7e70a7d0418c2163cc293b6f563feb6dcab

          SHA512

          e12dfd77e2010e2994c714d580eee4368770f19cbe75ebe314e600ff2537dbd2a5e3ae692e9925cf0657a461e50ca786744022ab7fd04b710e63e7444108157b

        • C:\Windows\System\spoolsv.exe

          Filesize

          65KB

          MD5

          816cdcc3720ee48da8f1f6e261cd9665

          SHA1

          b1d4cc0bb9b6909986c51cff8b0709180b329492

          SHA256

          d6e21b12415a4d314e1b83bef21dabc848a928674eaf995267e5a62774584fee

          SHA512

          5bfd916266d5d650ef17ada31ab379ca909078b5599b0c5aba2a8ca08fa84045c6b2ab342b46ab28cd2b755134aa522a583a811201cbb85b2b5eb7f7429e4dd2

        • C:\Windows\System\svchost.exe

          Filesize

          65KB

          MD5

          5f963ee6e49d6c01ad1435169b61c7f6

          SHA1

          e34486a554ea58031e0e59c0a2bacdaef199652d

          SHA256

          28b135c7739f0a67c5f02cc828d9ab8b428f4e037c2a0aa3d71d96f5a51d2a94

          SHA512

          3352f7128e096f83ddb141e22b165c85f7a4a2f14e5cb9af8017d13c2fc2dd5f2fdf8b873551b4049830f84dc9a5d54b79a296978d42d0a8796e1b8de28d962d

        • memory/760-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/760-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/760-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/760-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/760-2-0x0000000074D50000-0x0000000074EAD000-memory.dmp

          Filesize

          1.4MB

        • memory/760-57-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/760-58-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/760-56-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2060-35-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2060-36-0x0000000074D50000-0x0000000074EAD000-memory.dmp

          Filesize

          1.4MB

        • memory/2060-41-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2060-61-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2916-16-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2916-14-0x0000000074D50000-0x0000000074EAD000-memory.dmp

          Filesize

          1.4MB

        • memory/2916-13-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2916-59-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2916-70-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3636-53-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3636-25-0x0000000074D50000-0x0000000074EAD000-memory.dmp

          Filesize

          1.4MB

        • memory/5088-43-0x0000000074D50000-0x0000000074EAD000-memory.dmp

          Filesize

          1.4MB

        • memory/5088-51-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB