Analysis

  • max time kernel
    150s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 02:14

General

  • Target

    a693f5a78c3cedcf9c7755dfcddc26a06b8a753524d72bc84d1eec9a894241f6.exe

  • Size

    66KB

  • MD5

    c0ddf2d11b817b0f2367fae38b852ffe

  • SHA1

    cc2c460b329550973d77274934b4625370f80654

  • SHA256

    a693f5a78c3cedcf9c7755dfcddc26a06b8a753524d72bc84d1eec9a894241f6

  • SHA512

    c2f68be2ee178f54245128d45e6df68e411ad3dd14ae0bfbe55f766b69c3c65fa0886bd6b48f13fb0b02d17fe7a5255da71ba63b07c5691da7a89a761af74fe7

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXif:IeklMMYJhqezw/pXzH9if

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a693f5a78c3cedcf9c7755dfcddc26a06b8a753524d72bc84d1eec9a894241f6.exe
    "C:\Users\Admin\AppData\Local\Temp\a693f5a78c3cedcf9c7755dfcddc26a06b8a753524d72bc84d1eec9a894241f6.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5076
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1680
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:408
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4572
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1652
          • C:\Windows\SysWOW64\at.exe
            at 02:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:4128
            • C:\Windows\SysWOW64\at.exe
              at 02:17 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2092
              • C:\Windows\SysWOW64\at.exe
                at 02:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:3752

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          0103845767a62053863a1bf06eee5712

          SHA1

          4403dfeeb27e50074dd3b4670d2140261f6030b1

          SHA256

          d6cb7c9d450e3f8b58f3d0aa235a0739782d70bf4acbf967f75f2a992d9cc969

          SHA512

          1efaccff0e86ac6a6b800dce8f30c46b7dfb2c8a7a59fbfa13d86cd94e06801746b976cb63f6476e1b8f8bf2da784d5d6b7d18569c365c7d37385fabbeb5cf20

        • C:\Windows\System\explorer.exe

          Filesize

          66KB

          MD5

          4e91b4d262032edcae9eebeae738aa70

          SHA1

          a2c3e7691d7e05ba385ccb4351e47adfc41b6600

          SHA256

          4a5d9092d4d5e5e0e57b7a2fda086b7857bf7ec10ad81d9dc9f76f8f0663e20f

          SHA512

          9f295f0edc4e6f61aba2c28d5ada6cc98a1a5e1178d139b648ebf343e7edd5106fb2003072b0c6c42215ccab6b79b2c1d19381f3b65fb66ed721d4b0b97e1a2b

        • C:\Windows\System\spoolsv.exe

          Filesize

          66KB

          MD5

          e0ff28ba8a1a34612d241653d875954b

          SHA1

          08828d6a15c76c93eae9c5e73b8d85ed77c682bb

          SHA256

          6cf7d356f5bc31122022ca0fae533b3046469806dc79b3708e9644d4f049ee66

          SHA512

          598532d1eebf5b6dfe9b855f4139b33ccd8cf7396afb653e51ad2c57a4d905139e527dad516e2db94032752eaad558966957d2c8cc29a816a78ae973bece65d7

        • C:\Windows\System\svchost.exe

          Filesize

          66KB

          MD5

          80c8187a04679aa1f3bc0ff9c45dbb29

          SHA1

          04d95cb6ef1fcd66a48543bd03bd2d1c6038951f

          SHA256

          f8321a7aef4fa3160921ec6234a7bf3091989ae806eeafdb45c8594b37e8893e

          SHA512

          b81476437e7ecdd8b7fc6f279ef31bd790c02779600afa3f2ef6f2c72f0f8ca30c6eac6f555ec53bafd7a024bd3b06e7b93b9a4a52a03e7ceb2bfc86124091c0

        • memory/408-24-0x0000000075720000-0x000000007587D000-memory.dmp

          Filesize

          1.4MB

        • memory/408-56-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/408-28-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1652-53-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1652-46-0x0000000075720000-0x000000007587D000-memory.dmp

          Filesize

          1.4MB

        • memory/1680-13-0x0000000075720000-0x000000007587D000-memory.dmp

          Filesize

          1.4MB

        • memory/1680-16-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1680-71-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1680-60-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4572-35-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4572-36-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4572-37-0x0000000075720000-0x000000007587D000-memory.dmp

          Filesize

          1.4MB

        • memory/4572-41-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4572-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/5076-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/5076-2-0x0000000075720000-0x000000007587D000-memory.dmp

          Filesize

          1.4MB

        • memory/5076-58-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/5076-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/5076-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/5076-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/5076-45-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/5076-44-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/5076-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB