Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 02:14

General

  • Target

    a693f5a78c3cedcf9c7755dfcddc26a06b8a753524d72bc84d1eec9a894241f6.exe

  • Size

    66KB

  • MD5

    c0ddf2d11b817b0f2367fae38b852ffe

  • SHA1

    cc2c460b329550973d77274934b4625370f80654

  • SHA256

    a693f5a78c3cedcf9c7755dfcddc26a06b8a753524d72bc84d1eec9a894241f6

  • SHA512

    c2f68be2ee178f54245128d45e6df68e411ad3dd14ae0bfbe55f766b69c3c65fa0886bd6b48f13fb0b02d17fe7a5255da71ba63b07c5691da7a89a761af74fe7

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXif:IeklMMYJhqezw/pXzH9if

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a693f5a78c3cedcf9c7755dfcddc26a06b8a753524d72bc84d1eec9a894241f6.exe
    "C:\Users\Admin\AppData\Local\Temp\a693f5a78c3cedcf9c7755dfcddc26a06b8a753524d72bc84d1eec9a894241f6.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2452
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2956
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2512
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2468
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2416
          • C:\Windows\SysWOW64\at.exe
            at 02:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1956
            • C:\Windows\SysWOW64\at.exe
              at 02:17 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2708
              • C:\Windows\SysWOW64\at.exe
                at 02:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:3068

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          9e61bdb7a3896af1f3472d16f6b08c17

          SHA1

          f99a553652b6ef4195bbfa0478a9a743eec4936e

          SHA256

          5e154d1569d4bd4b5bd509ee047b40b9e38e012b99e17bbafe3903fe9ba2f31e

          SHA512

          58747aa83a9a6f3865263c1bf819da4304d03594e639cf20af405ac40e05e753080f5ecfdae9eb5007d8f8eb40a7e3cbcddf248b975e90745934e4d438d0aa87

        • \??\PIPE\atsvc

          MD5

          d41d8cd98f00b204e9800998ecf8427e

          SHA1

          da39a3ee5e6b4b0d3255bfef95601890afd80709

          SHA256

          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

          SHA512

          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

        • \Windows\system\explorer.exe

          Filesize

          66KB

          MD5

          6d6000d8340d52075a77fc4538c61634

          SHA1

          33e45c5852f9a448e5152420c9f47951ed47b084

          SHA256

          e810cda46edeb2f0b175d58ef1bbb2274a7026666ce695ef6d1d644e0e40d608

          SHA512

          1dd06d3197ea3e1060a3245065283f387bb0c34fd7334310a5c8c98056c9bc4db763fb8cf3311403ce261946dbe27ab31572f7c9cc5598181e2d7fcee153c560

        • \Windows\system\spoolsv.exe

          Filesize

          66KB

          MD5

          7c8a684bfb8d828778ead8b3bf36f2fd

          SHA1

          1f9479fa42467ecd30b17555e7d6e119a5d67602

          SHA256

          2e4afbe778824e150077b3d1ec854161fb69b1364fc941d2006a0ea070d84955

          SHA512

          09abae03a31cc95ef59de263d835dee621cb1195727f2dfd0a0fb110f8bd661b5eae23045aa6244afb1bbe4343fd471193086c4b803390f0b2b7a44784f97513

        • \Windows\system\svchost.exe

          Filesize

          66KB

          MD5

          c6c2e9400e656ccc61985b6454021e19

          SHA1

          a939cd9831ed2b0afd913ac1655c5dee63837fc1

          SHA256

          56ceee886b567c4527d27ebbe8277804dd75f671533e75b3c4ea60bbbc1d0f21

          SHA512

          fe920cd4c201611803c9637ac8bb936ecab9dac4ad6aec28fbadf31c99115994e30600f297136e527e8be2ab34b9641fe360396e9647f84cfa1c752cbe9a2dcf

        • memory/2416-74-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2416-68-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2452-54-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2452-80-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2452-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2452-2-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2452-79-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2452-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2452-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2452-11-0x0000000002CB0000-0x0000000002CE1000-memory.dmp

          Filesize

          196KB

        • memory/2452-60-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2452-1-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2468-67-0x00000000029E0000-0x0000000002A11000-memory.dmp

          Filesize

          196KB

        • memory/2468-85-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2468-56-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2468-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2468-55-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2512-77-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2512-41-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2512-36-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2512-52-0x00000000025F0000-0x0000000002621000-memory.dmp

          Filesize

          196KB

        • memory/2512-35-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2512-51-0x00000000025F0000-0x0000000002621000-memory.dmp

          Filesize

          196KB

        • memory/2956-22-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2956-34-0x0000000001F80000-0x0000000001FB1000-memory.dmp

          Filesize

          196KB

        • memory/2956-82-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2956-83-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2956-94-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2956-18-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB