01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe
Size

66KB
MD5

5f5926a6a95556b9d29ac14cee9cb370
SHA1

e22a2ad1ccfd8a9b9763c3b4325fa50a20c57134
SHA256

01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837
SHA512

789d7e3748e4df9fcc32b4ef1f41b2cb6905154efe2138071530f133b4a4cd62661132e049fedfba2c40e289ac9f86b92809531feb09f2c68969cbbe7a5795c8
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi9:IeklMMYJhqezw/pXzH9i9

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2984	explorer.exe
2748	spoolsv.exe
2792	svchost.exe
2584	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2316	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe
2316	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe
2984	explorer.exe
2984	explorer.exe
2748	spoolsv.exe
2748	spoolsv.exe
2792	svchost.exe
2792	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2316	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe
2984	explorer.exe
2984	explorer.exe
2984	explorer.exe
2792	svchost.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe
2984	explorer.exe
2792	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2984	explorer.exe
2792	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2316	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe
2316	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe
2984	explorer.exe
2984	explorer.exe
2748	spoolsv.exe
2748	spoolsv.exe
2792	svchost.exe
2792	svchost.exe
2584	spoolsv.exe
2584	spoolsv.exe
2984	explorer.exe
2984	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2984	2316	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe	28
PID 2316 wrote to memory of 2984	2316	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe	28
PID 2316 wrote to memory of 2984	2316	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe	28
PID 2316 wrote to memory of 2984	2316	01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe	28
PID 2984 wrote to memory of 2748	2984	explorer.exe	29
PID 2984 wrote to memory of 2748	2984	explorer.exe	29
PID 2984 wrote to memory of 2748	2984	explorer.exe	29
PID 2984 wrote to memory of 2748	2984	explorer.exe	29
PID 2748 wrote to memory of 2792	2748	spoolsv.exe	30
PID 2748 wrote to memory of 2792	2748	spoolsv.exe	30
PID 2748 wrote to memory of 2792	2748	spoolsv.exe	30
PID 2748 wrote to memory of 2792	2748	spoolsv.exe	30
PID 2792 wrote to memory of 2584	2792	svchost.exe	31
PID 2792 wrote to memory of 2584	2792	svchost.exe	31
PID 2792 wrote to memory of 2584	2792	svchost.exe	31
PID 2792 wrote to memory of 2584	2792	svchost.exe	31
PID 2792 wrote to memory of 3004	2792	svchost.exe	32
PID 2792 wrote to memory of 3004	2792	svchost.exe	32
PID 2792 wrote to memory of 3004	2792	svchost.exe	32
PID 2792 wrote to memory of 3004	2792	svchost.exe	32
PID 2792 wrote to memory of 1212	2792	svchost.exe	36
PID 2792 wrote to memory of 1212	2792	svchost.exe	36
PID 2792 wrote to memory of 1212	2792	svchost.exe	36
PID 2792 wrote to memory of 1212	2792	svchost.exe	36
PID 2792 wrote to memory of 896	2792	svchost.exe	38
PID 2792 wrote to memory of 896	2792	svchost.exe	38
PID 2792 wrote to memory of 896	2792	svchost.exe	38
PID 2792 wrote to memory of 896	2792	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe
"C:\Users\Admin\AppData\Local\Temp\01f1d58f0a432ef693b1f7c78e10bdb490c1d3533c9f2ca487e2183bf0352837.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2984
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3004
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1212
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
655950ee3775151232b56274bcdb335c

SHA1
7395316aa18577d2a48226a883016e5301ff8bdd

SHA256
37982dcb754675eee4251acde40b56071a0993451510de579cd0bd8198492bf4

SHA512
88901e3ef88764a58533d15163504bccd6cad4a74af283734ca612019f76e49aef620a82f7bb34feb8f693880389fc3b22c5a9970387fb0f6d3c65fa398d5260

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
66KB

MD5
b37550bdac923e4c4f65c55df781ef75

SHA1
c880afa985aab65f2d862afb96716eb64f8a1e73

SHA256
eea282c0e607d00078ede14c56f9b49e8107237d97c6b65ee746fbcf9770688c

SHA512
d283590305f46acd60990952e2f2f29f5f82db664b42e270b68527cf2ba0f4c1271a664cb2efb001956d87ce4bed9d418ae86f83e424dc501bc180b766f73b10

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
6fb3c61778cb9a03cf712d5a3ce3bef8

SHA1
e3927a779eaa570308f8e60305186ee9647ecc65

SHA256
18b9c459f606bcc904aed78c09409fbd386ccc4a0be5148b4c61ac0c5ec574e1

SHA512
301466d3324e46abff3b308ad943d35bc965ca818ea19b5631d01a2e974da17f30551da82938597aee8ddd06ed0c94501cea683e52de62e4cb84bba43f6bb52e

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
bab2f41569e1a84735b4aae308bb9cfc

SHA1
542122f97aad26b6cf1e638d815f840b2e1a2f84

SHA256
bfc7dc9a69203b0b46160eb7166332049070a42e3f252865ec6f3d4e0326d45c

SHA512
6cae293d84f9d97bd59282fd6c80a15dc26e95ce9ac018a30593e0a6ae3cf13531773bc5ee43e0f3caeaaa74f6860b81a37ba3702e981f62b377de590839327b

Download Submit
memory/2316-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2316-18-0x00000000025F0000-0x0000000002621000-memory.dmp

Filesize
196KB

Download
memory/2316-17-0x00000000025F0000-0x0000000002621000-memory.dmp

Filesize
196KB

Download
memory/2316-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2316-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2316-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2316-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2316-81-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2316-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2316-65-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2584-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2584-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2584-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2748-53-0x00000000025A0000-0x00000000025D1000-memory.dmp

Filesize
196KB

Download
memory/2748-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2748-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2748-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2748-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2748-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2792-85-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2792-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2792-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2792-69-0x00000000025D0000-0x0000000002601000-memory.dmp

Filesize
196KB

Download
memory/2984-35-0x0000000003180000-0x00000000031B1000-memory.dmp

Filesize
196KB

Download
memory/2984-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2984-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2984-94-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2984-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download