Analysis

  • max time kernel
    150s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 05:12

General

  • Target

    e2f6827b8d407d565efba8e379857f97fc2c8301eb616a8bce416e6629a7d4c8.exe

  • Size

    66KB

  • MD5

    f2eb0d01d52d396195df508764cb2977

  • SHA1

    73d4d0bb392f682af090408196f3c1d2d8d3b772

  • SHA256

    e2f6827b8d407d565efba8e379857f97fc2c8301eb616a8bce416e6629a7d4c8

  • SHA512

    bc585e4bc517c3bff4be4e30edf53ee9aa1374f9c8ad374704a0eadd13a97bf3ca0eafaad3decadfca8edd0ebb769e4cc5e5b1fd9f6226cd60c381afd215e6bb

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiR:IeklMMYJhqezw/pXzH9iR

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2f6827b8d407d565efba8e379857f97fc2c8301eb616a8bce416e6629a7d4c8.exe
    "C:\Users\Admin\AppData\Local\Temp\e2f6827b8d407d565efba8e379857f97fc2c8301eb616a8bce416e6629a7d4c8.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4028
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4400
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1928
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3924
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:5060
          • C:\Windows\SysWOW64\at.exe
            at 05:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:4992
            • C:\Windows\SysWOW64\at.exe
              at 05:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:3628
              • C:\Windows\SysWOW64\at.exe
                at 05:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:4428

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          8675441fe48540f0876fb8100c0571ce

          SHA1

          5354e38fc89976591113b793a3fee530bddbb28d

          SHA256

          09f5432976e6e426254e82ce6f13b375747dc40e66b3af88613cf3f01f24c3ba

          SHA512

          66fd12cee2d206f16a306abd347453f2faf4789a91eb668a62b8712c196ad8465c8f351823bc895620da9cca16fde753e0163d3a8233be3d71b763c42ead204e

        • C:\Windows\System\explorer.exe

          Filesize

          66KB

          MD5

          b063f4906f019c7179f9c31a79a78792

          SHA1

          6d5c67e568b8cec023190d944d572b0a56310772

          SHA256

          3bf17da7e412c31dc28fb37d974f9b59f5ac9d4df3590b1e244c51f45275587f

          SHA512

          6b7060b5a4bcef0bfc3718d75092ab14bba9be8de82dc4cfba7c5bd469f8be1f5b9595870ed504783ef345780ed03e8487f7c0c9ec2d6c2b1f2a00ab4472325a

        • C:\Windows\System\spoolsv.exe

          Filesize

          66KB

          MD5

          c7a369e9109ec88dd58402e2fad8f3b1

          SHA1

          71bf3cf7898d4a701d7044ae4e7e0ab93be6078b

          SHA256

          e1848bd79115a9350b4c97cfe1e9277a324c1524a3647c91d545d8ac8fa2797c

          SHA512

          0170b06412d86c9d0890baf64541bcd72fb1bc3c306555fa89f4b81f1193f7a8d9da177feb52191603cb27db8cd2984df204b420b4ba891018b7a5414b5ae05e

        • C:\Windows\System\svchost.exe

          Filesize

          66KB

          MD5

          137e69fa90ee3b9eda8ac002d9cd73d0

          SHA1

          9532c5f1d3282d4fb066dddd76b03650233bf8e1

          SHA256

          2325b47e5f579ac3138cf0d51c0b7cc7291651f0e7d6f063f463ecbf1e3e3467

          SHA512

          0d1a978b130d1b2e6e96fe770b62c392ee549799a8db70aa8da362d18ab0c4608f0a5e0186f32cbc4aebda1f3d9c26dbb47b8309b08f049828c513ef3c2278d3

        • memory/1928-27-0x0000000075790000-0x00000000758ED000-memory.dmp

          Filesize

          1.4MB

        • memory/1928-55-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1928-31-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1928-26-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1928-25-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3924-43-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3924-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3924-38-0x0000000075790000-0x00000000758ED000-memory.dmp

          Filesize

          1.4MB

        • memory/4028-2-0x0000000075790000-0x00000000758ED000-memory.dmp

          Filesize

          1.4MB

        • memory/4028-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4028-1-0x00000000001D0000-0x00000000001D4000-memory.dmp

          Filesize

          16KB

        • memory/4028-5-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/4028-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4028-58-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/4028-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4400-15-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4400-13-0x0000000075790000-0x00000000758ED000-memory.dmp

          Filesize

          1.4MB

        • memory/4400-60-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4400-16-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4400-71-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/5060-51-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/5060-45-0x0000000075790000-0x00000000758ED000-memory.dmp

          Filesize

          1.4MB