01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe
Size

66KB
MD5

00cfdaf02d05e7e54723e44f1779768b
SHA1

58a6c9696a49c988639dc8a5c87d545a49a3fbdc
SHA256

01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434
SHA512

b22618323a16fa83ba5c67eb1f30e28d64b86e1cef9fee12f6e3f337ab5f1f5d3819f66af2b7778033e2f772436da47695dadc75183ba2b97162de62a0f23dbc
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiH:IeklMMYJhqezw/pXzH9iH

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2856	explorer.exe
2512	spoolsv.exe
2808	svchost.exe
2416	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2088	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe
2088	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe
2856	explorer.exe
2856	explorer.exe
2512	spoolsv.exe
2512	spoolsv.exe
2808	svchost.exe
2808	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2088	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe
2856	explorer.exe
2856	explorer.exe
2856	explorer.exe
2856	explorer.exe
2808	svchost.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe
2808	svchost.exe
2856	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2856	explorer.exe
2808	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2088	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe
2088	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe
2856	explorer.exe
2856	explorer.exe
2512	spoolsv.exe
2512	spoolsv.exe
2808	svchost.exe
2808	svchost.exe
2416	spoolsv.exe
2416	spoolsv.exe
2856	explorer.exe
2856	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2856	2088	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe	28
PID 2088 wrote to memory of 2856	2088	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe	28
PID 2088 wrote to memory of 2856	2088	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe	28
PID 2088 wrote to memory of 2856	2088	01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe	28
PID 2856 wrote to memory of 2512	2856	explorer.exe	29
PID 2856 wrote to memory of 2512	2856	explorer.exe	29
PID 2856 wrote to memory of 2512	2856	explorer.exe	29
PID 2856 wrote to memory of 2512	2856	explorer.exe	29
PID 2512 wrote to memory of 2808	2512	spoolsv.exe	30
PID 2512 wrote to memory of 2808	2512	spoolsv.exe	30
PID 2512 wrote to memory of 2808	2512	spoolsv.exe	30
PID 2512 wrote to memory of 2808	2512	spoolsv.exe	30
PID 2808 wrote to memory of 2416	2808	svchost.exe	31
PID 2808 wrote to memory of 2416	2808	svchost.exe	31
PID 2808 wrote to memory of 2416	2808	svchost.exe	31
PID 2808 wrote to memory of 2416	2808	svchost.exe	31
PID 2808 wrote to memory of 804	2808	svchost.exe	32
PID 2808 wrote to memory of 804	2808	svchost.exe	32
PID 2808 wrote to memory of 804	2808	svchost.exe	32
PID 2808 wrote to memory of 804	2808	svchost.exe	32
PID 2808 wrote to memory of 2228	2808	svchost.exe	36
PID 2808 wrote to memory of 2228	2808	svchost.exe	36
PID 2808 wrote to memory of 2228	2808	svchost.exe	36
PID 2808 wrote to memory of 2228	2808	svchost.exe	36
PID 2808 wrote to memory of 696	2808	svchost.exe	38
PID 2808 wrote to memory of 696	2808	svchost.exe	38
PID 2808 wrote to memory of 696	2808	svchost.exe	38
PID 2808 wrote to memory of 696	2808	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe
"C:\Users\Admin\AppData\Local\Temp\01135d1cf63f250c023ff209d643e38893ac3ea28fa92e68a3b4905c2d3bf434.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2856
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:804
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:57 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2228
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:58 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
ba0bb0c513e659839806bd2f1da829bb

SHA1
218655dc55f4831a2dfd326f0769894500c00a82

SHA256
316900b2f3a4863defd0c5aada0187a129832367756e12c3a742db95cdbdf8f5

SHA512
82275388a39861c0716b81d81c6013c7e7fd53ff38d2f186604b188aa2c384ff04632592243e39fca7dbd47289eff976c6b8c0d280047d130a791b0241cf24aa

Download Submit
C:\Windows\system\svchost.exe

Filesize
66KB

MD5
23f79933ba63efd3c1c2ef8d715cf3d6

SHA1
0627a5833958d38d709da3c412cfe1b7a9714c1d

SHA256
eaabec8d668684488dde826a8d2f93253de1561ad69caed4665b1eec44fec24f

SHA512
7c9cf1b3df4321239782ac93fb9563240a355e68cd9382f0313e5eaa2cd179be6b258f11508599d812237c792601947aeeecf63aeca6d7aa9079075dcbd3f9d1

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
b9c23751dc20b9c9654663e440edc4b2

SHA1
7a8bfd38f8adea16bad886fe6ba947df62fae0c3

SHA256
a3b8d4c9a7ae6d6eb170b2dd824fb5b57c34706d65eac4a1e994f4fcc33b9965

SHA512
7ff6c7be96424d45ad8283fd89734afb8186d2a50a78e7144eb26f67534226df83474088730e09a6259494c1d267cf03558f68b547ae872616fe8f50f2e785f6

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
accf4337ccf88cb25bb5df9fa89314d8

SHA1
fabea4dd8661732af55a6885487db0e3c80821a0

SHA256
34b85f39b81617dc60fdbf9686744277e591fff0de7c557271b59f26bb437032

SHA512
e40b3dc4b02cc293af0aa75294139ee3f97f09cee1fbb563c0df079cde29f412182bcbe1e6b748be86e9e6b8696ef5e4d1d0bdc17644c8501a239a4ef00a6dd3

Download Submit
memory/2088-17-0x0000000002840000-0x0000000002871000-memory.dmp

Filesize
196KB

Download
memory/2088-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2088-80-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2088-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2088-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2088-18-0x0000000002840000-0x0000000002871000-memory.dmp

Filesize
196KB

Download
memory/2088-62-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2088-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2088-2-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2088-0-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2416-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2416-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2512-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2512-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2512-55-0x0000000000830000-0x0000000000861000-memory.dmp

Filesize
196KB

Download
memory/2512-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2808-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2808-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2808-64-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2808-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2856-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2856-67-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2856-36-0x00000000026F0000-0x0000000002721000-memory.dmp

Filesize
196KB

Download
memory/2856-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2856-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2856-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2856-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download