ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe
Size 66KB
Sample240614-ges2hsxbnb
SHA256 ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90
MD5 a83f220b528245b10c681a8bc454d346
SHA1 eec6d8415e79d37965b5183e8a19981525d1716f
SHA512 cba429c825630dde444e21341ee916fa94f6f5ebf5640719567346d420718429d639e075a8fcfcd22ca78c5b3f458a348b8f612387e5c493b9a1314c23319080
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXip:IeklMMYJhqezw/pXzH9ip
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1588	explorer.exe
3372	spoolsv.exe
5064	svchost.exe
4916	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4272	ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe
4272	ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe
1588	explorer.exe
1588	explorer.exe
5064	svchost.exe
5064	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1588	explorer.exe
5064	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4272	ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe
4272	ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe
1588	explorer.exe
1588	explorer.exe
3372	spoolsv.exe
3372	spoolsv.exe
5064	svchost.exe
5064	svchost.exe
4916	spoolsv.exe
4916	spoolsv.exe
1588	explorer.exe
1588	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1588	4272	ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe	81
PID 4272 wrote to memory of 1588	4272	ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe	81
PID 4272 wrote to memory of 1588	4272	ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe	81
PID 1588 wrote to memory of 3372	1588	explorer.exe	83
PID 1588 wrote to memory of 3372	1588	explorer.exe	83
PID 1588 wrote to memory of 3372	1588	explorer.exe	83
PID 3372 wrote to memory of 5064	3372	spoolsv.exe	84
PID 3372 wrote to memory of 5064	3372	spoolsv.exe	84
PID 3372 wrote to memory of 5064	3372	spoolsv.exe	84
PID 5064 wrote to memory of 4916	5064	svchost.exe	86
PID 5064 wrote to memory of 4916	5064	svchost.exe	86
PID 5064 wrote to memory of 4916	5064	svchost.exe	86
PID 5064 wrote to memory of 3320	5064	svchost.exe	88
PID 5064 wrote to memory of 3320	5064	svchost.exe	88
PID 5064 wrote to memory of 3320	5064	svchost.exe	88
PID 5064 wrote to memory of 2780	5064	svchost.exe	93
PID 5064 wrote to memory of 2780	5064	svchost.exe	93
PID 5064 wrote to memory of 2780	5064	svchost.exe	93
PID 5064 wrote to memory of 3928	5064	svchost.exe	95
PID 5064 wrote to memory of 3928	5064	svchost.exe	95
PID 5064 wrote to memory of 3928	5064	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe
"C:\Users\Admin\AppData\Local\Temp\ede9969bee5c4fbd48f7ad6bbf049ba9bee96a2e392a51632a862b2646360c90.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1588
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3320
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2780
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 172f4fb97711f390a6ee9da412bae1eed9946a7de7bd032665b421a24c12c6fb
MD5 0c07704fd3a524685252e3d9d56abfad
SHA1 7da6066ec2fd3be5409f32472552c89437fd5b4f
SHA512 7382d98af97396d48370da37a6a6993cd4091eda51c374aa722e4a774e75e05779bb865a87aa162267e1880c31aef26d2e0ceba64d025814c7656d8434f5acd9
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiV:IeklMMYJhqezw/pXzH9iV
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 66KB
SHA256 ff5c50e86559fc54d9a359ab7e1bb385f7fa3da5cf648a34e45ccfed5af92612
MD5 bf6f1285b3da4abe5e044151676d59b6
SHA1 abcee1881c25e3d644e94fbe2ba3767099a22be1
SHA512 29905679b66943ebaa1b83e43859f6e38af40bbfed30157b679b3892ba9b382fa2efe557f32de83d3f585a5384ca26d1ecf0f15dff7a3a3008608b5535deec6a
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiW:IeklMMYJhqezw/pXzH9iW
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 71acc8322a7dfea224a97c4cca6b8f1edb962e2db95edfaac1eaee1ed9fd1287
MD5 bc387097e6a19b938cf6d718491eff9b
SHA1 283d94028d06e0aee9ad41bd3fb5fe9ccc28f0f5
SHA512 3d84a4f958d3cc0235e5dd265e8385420cc219aba4cd292cb81ad6a8a1fc4e259f5ebab301cde0d12243190f8a09190932ae662855569c0473411d27dc4aefd4
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi2:IeklMMYJhqezw/pXzH9i2
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 0d49d8bdbbc19f4df3104524c5b7b9307933963a48df62cd050387fc1418a674
MD5 a030f8d2f8dd88a20efe9d865d15c881
SHA1 0972a99859440a752f2c11ed593e4839fd2cd453
SHA512 f13a9826ce235cb82319ad98582f604874439129fc13e155cff42535bfde8ae9d1e06b0467892aa8af21823de332e0633fbdfccc88e2cbbb8f963ebf245afc5b
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiZrrrrrrrrrrrrrrrrrrrrD:IeklMMYJhqezw/pXzH9iZrrrrrrrrrrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1588-71-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1588-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1588-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1588-14-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1588-15-0x0000000074CB0000-0x0000000074E0D000-memory.dmp

Download

memory/1588-18-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3372-27-0x0000000074CB0000-0x0000000074E0D000-memory.dmp

Download

memory/3372-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3372-25-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3372-31-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4272-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4272-45-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4272-6-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4272-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4272-58-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4272-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4272-2-0x0000000074CB0000-0x0000000074E0D000-memory.dmp

Download

memory/4272-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/4916-46-0x0000000074CB0000-0x0000000074E0D000-memory.dmp

Download

memory/4916-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5064-38-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5064-39-0x0000000074CB0000-0x0000000074E0D000-memory.dmp

Download

memory/5064-62-0x0000000000400000-0x0000000000431000-memory.dmp

Download