b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6

Analysis

max time kernel
150s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe
Size 67KB
Sample240614-dpy4qsxanl
SHA256 b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6
MD5 0a92a7664b0e89887437c2962efc24a0
SHA1 a0c29bca7cb68c97bc77198cb3a918f8477beb48
SHA512 d469ca99b59f44d328918f0f647f567baf901e314effa98c4dd4ea9274798d6409149edc5607721955c0a83d3c6dc48922224d67a6cdf7051c583912383c6403
SSDEEP 1536:EgXsfgWQN1kYsRxWTg3PwSWe991Rdolpdz6JAkAU:1tWYfGATvPe9slp+ApU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
5976	explorer.exe
4140	spoolsv.exe
3288	svchost.exe
4892	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3152	b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe
3152	b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe
5976	explorer.exe
5976	explorer.exe
5976	explorer.exe
5976	explorer.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe
5976	explorer.exe
5976	explorer.exe
3288	svchost.exe
3288	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5976	explorer.exe
3288	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3152	b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe
3152	b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe
5976	explorer.exe
5976	explorer.exe
4140	spoolsv.exe
4140	spoolsv.exe
3288	svchost.exe
3288	svchost.exe
4892	spoolsv.exe
4892	spoolsv.exe
5976	explorer.exe
5976	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 5976	3152	b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe	81
PID 3152 wrote to memory of 5976	3152	b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe	81
PID 3152 wrote to memory of 5976	3152	b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe	81
PID 5976 wrote to memory of 4140	5976	explorer.exe	82
PID 5976 wrote to memory of 4140	5976	explorer.exe	82
PID 5976 wrote to memory of 4140	5976	explorer.exe	82
PID 4140 wrote to memory of 3288	4140	spoolsv.exe	83
PID 4140 wrote to memory of 3288	4140	spoolsv.exe	83
PID 4140 wrote to memory of 3288	4140	spoolsv.exe	83
PID 3288 wrote to memory of 4892	3288	svchost.exe	84
PID 3288 wrote to memory of 4892	3288	svchost.exe	84
PID 3288 wrote to memory of 4892	3288	svchost.exe	84
PID 3288 wrote to memory of 4412	3288	svchost.exe	85
PID 3288 wrote to memory of 4412	3288	svchost.exe	85
PID 3288 wrote to memory of 4412	3288	svchost.exe	85
PID 3288 wrote to memory of 5092	3288	svchost.exe	94
PID 3288 wrote to memory of 5092	3288	svchost.exe	94
PID 3288 wrote to memory of 5092	3288	svchost.exe	94
PID 3288 wrote to memory of 3844	3288	svchost.exe	96
PID 3288 wrote to memory of 3844	3288	svchost.exe	96
PID 3288 wrote to memory of 3844	3288	svchost.exe	96

C:\Users\Admin\AppData\Local\Temp\b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe
"C:\Users\Admin\AppData\Local\Temp\b7e95856ae5b958fab2238a51116e5fd802dcb7749f9a35a2092c119dfc21ce6.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5976
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4892
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4412
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:5092
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 67KB
SHA256 649aa85de4e31f99eaba20bdbd55c23645f54f2eae2795c851a114fa28238139
MD5 5bfaa08bd060d8c4d94ab1a0db460a62
SHA1 e8140f8c18bff84a0a50f257f4aac7ea64ffc8b0
SHA512 01e4fb78b669d2ee5f409a37aea4bfc377cb5b94d92d118757ca2341c76907d08154ae40a0489d133ef59a8c87110ddda49a6a0a435f3013c42105ca0b68e1c1
SSDEEP 1536:EgXsfgWQN1kYsRxWTg3PwSWe991Rdolpdz6JAkA3:1tWYfGATvPe9slp+Ap3
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 67KB
SHA256 2e55888dce2ffc930a4807bf47a19a08583b453ddd0a90b4aa6df0a3ab6e7cc8
MD5 93569ead058bf28759e905ca99f2ae42
SHA1 2a37da2e4a878ae2509cd6f7c0013b5408497a1a
SHA512 4a7bfede39b7f062882c171c36d36b30a1790953d8dcc7904a7c7b62a9b03d79d3d273e5b2906b36ff9fe71b9a42aceb7b90a95e1bafa78037f5dd474148d362
SSDEEP 1536:EgXsfgWQN1kYsRxWTg3PwSWe991Rdolpdz6JAkAP:1tWYfGATvPe9slp+ApP
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 67KB
SHA256 636a269654dcf318a28af76c20c5fa8f98acd8a5b5f57918c932d04a28ca9f7c
MD5 2421bc06ea2e6eba9140d55e5731df2c
SHA1 a6fe02d58cb43788260ae0ad8ca3866985635cce
SHA512 9d29ff1dd2fb7412b1e444f9493ce2743c7405911515f427e97c96e58f2c818f287b474809377ce888721c24a695e5a019fd73d3051afc9bc8d865b507b2ba30
SSDEEP 1536:EgXsfgWQN1kYsRxWTg3PwSWe991Rdolpdz6JAkAa:1tWYfGATvPe9slp+Apa
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \??\c:\windows\system\svchost.exe
Size 67KB
SHA256 a4e56716762bb8e372b2ccf1efe3343cc5e80069d9543ce63ef6dde84610a84d
MD5 3151fc857e9ed6b05772496c692d430d
SHA1 d33e3ee80be007fcb7b4f6e138c3226e137a3dbf
SHA512 96b185891e7c5fa00bddd04ae049e75a48c1b83f8e292c0e938d03b43a0b3b36ea26a222d58054e2be24b40a1480c04dc93cc0b7809bd3566108c3f3328d8f89
SSDEEP 1536:EgXsfgWQN1kYsRxWTg3PwSWe991Rdolpdz6JAkAa:1tWYfGATvPe9slp+Apa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3152-2-0x0000000074FC0000-0x000000007511D000-memory.dmp

Download

memory/3152-5-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/3152-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3152-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3152-55-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/3152-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3152-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/3288-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3288-38-0x0000000074FC0000-0x000000007511D000-memory.dmp

Download

memory/4140-27-0x0000000074FC0000-0x000000007511D000-memory.dmp

Download

memory/4140-31-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4140-26-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4140-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4892-44-0x0000000074FC0000-0x000000007511D000-memory.dmp

Download

memory/4892-52-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5976-18-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5976-15-0x0000000074FC0000-0x000000007511D000-memory.dmp

Download

memory/5976-14-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5976-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5976-12-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5976-67-0x0000000000400000-0x0000000000431000-memory.dmp

Download