Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 05:01

General

  • Target

    de9e2b7e3ced43c89a64921493b3ae58f27f34f586022364d34dfc07f2420c66.exe

  • Size

    66KB

  • MD5

    0cd879162cdd7710c44cfbb1695a7ea3

  • SHA1

    186fac979e1e45849bbb528e55c315058a275ca2

  • SHA256

    de9e2b7e3ced43c89a64921493b3ae58f27f34f586022364d34dfc07f2420c66

  • SHA512

    6f5d06febfc489bd7a129d42db111b01b046e1e7e7877766f52a81af4b96716bb824f9c6bf49a203f8cc040730845d2852d9d14d769f609c528b35dfbc774a23

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXie:IeklMMYJhqezw/pXzH9ie

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de9e2b7e3ced43c89a64921493b3ae58f27f34f586022364d34dfc07f2420c66.exe
    "C:\Users\Admin\AppData\Local\Temp\de9e2b7e3ced43c89a64921493b3ae58f27f34f586022364d34dfc07f2420c66.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4244
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1600
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4212
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1364
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3800
          • C:\Windows\SysWOW64\at.exe
            at 05:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2888
            • C:\Windows\SysWOW64\at.exe
              at 05:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:4912
              • C:\Windows\SysWOW64\at.exe
                at 05:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:4404

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          c47ec858a589450d8c2468e174c7c140

          SHA1

          86fe0f5ba2792606762cbb96f49f55437c9f5736

          SHA256

          22ae54d5afefa08628b6ba3363c32ecfa820d8a3be2454a23ac35c9b1fb6880f

          SHA512

          064c69de0a4a6ff63fe71d14d7da2b18a70793b5e257ec41ed9c7ad2500b5180477d0102a86da879313760e62643a5f4a27085694eaa5dd409b51d7a0476adb5

        • C:\Windows\System\explorer.exe

          Filesize

          66KB

          MD5

          d6aa79ac6471299ab40e90a2074a2655

          SHA1

          6b0e759719ef9d0209a6cb92b642a46ab4391c00

          SHA256

          4c4865383091d86906fbe291de76c6c222c8e74da3348cb138495813a9013c09

          SHA512

          17e6d460091502e37cc52675cc23d9ea35235dec813dc39d7a07d5291f6aecd1b03cbd6b4b85814b2ac20af619ada0e00778ae49db7d2f7608f348831632772f

        • C:\Windows\System\spoolsv.exe

          Filesize

          66KB

          MD5

          75e6135afde03df38a10ae82a06ef572

          SHA1

          7c3c60c9eebee01f13d855e88b58dd7c2764a849

          SHA256

          c0a4a3b452410ba49350b5ab9bb0a0797b1333b3e49fab275b85b228fb1b6693

          SHA512

          c8f942e852f1fe51301f0b06b6f6997aad4d07bd44cf6493c4a99254c51d12579e2c7ac88aaf6a1b46a026deb78ecd622e5b9c93dac55b56319fa6cc9db22714

        • C:\Windows\System\svchost.exe

          Filesize

          66KB

          MD5

          d3953365851d4ed574df59ebf35d7964

          SHA1

          3c5abb69594fee6456c3e0fcc7f81785cf1eca7a

          SHA256

          7106e5c4f4ce775df797997d4ec97541241ce291a89bdd6a55379d67679c0619

          SHA512

          7ae4c6e45548e1c019272854319941b774e248d8cb298ecbc29e0af877cf9caefae3a13b787e699e59c15091315617c34c6de1083a2669f4b9c903a0403a00ce

        • memory/1364-60-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1364-40-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1364-36-0x00000000757F0000-0x000000007594D000-memory.dmp

          Filesize

          1.4MB

        • memory/1364-34-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1600-16-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1600-69-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1600-14-0x00000000757F0000-0x000000007594D000-memory.dmp

          Filesize

          1.4MB

        • memory/1600-58-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1600-13-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3800-43-0x00000000757F0000-0x000000007594D000-memory.dmp

          Filesize

          1.4MB

        • memory/3800-49-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4212-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4212-25-0x00000000757F0000-0x000000007594D000-memory.dmp

          Filesize

          1.4MB

        • memory/4244-2-0x00000000757F0000-0x000000007594D000-memory.dmp

          Filesize

          1.4MB

        • memory/4244-55-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/4244-5-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/4244-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4244-53-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4244-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4244-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB