bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe
Size

65KB
MD5

90d8c9f1600e1d99fa81496c099f3b13
SHA1

52b4ddcb4934374f5209d48b9d6288e9c409f565
SHA256

bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336
SHA512

7a8242e5cab2dcf5052a4a0f2636352749c5680fb3aab6c9b40abd5a707938df8c2a10f96860f56d79b971102be9eff28f8e24e18f59f0d21f1bbae0be047182
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ous:7WNqkOJWmo1HpM0MkTUmus

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2744	explorer.exe
2652	spoolsv.exe
2452	svchost.exe
2640	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2012	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe
2012	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe
2744	explorer.exe
2744	explorer.exe
2652	spoolsv.exe
2652	spoolsv.exe
2452	svchost.exe
2452	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2012	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2452	svchost.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe
2452	svchost.exe
2744	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2744	explorer.exe
2452	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2012	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe
2012	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe
2744	explorer.exe
2744	explorer.exe
2652	spoolsv.exe
2652	spoolsv.exe
2452	svchost.exe
2452	svchost.exe
2640	spoolsv.exe
2640	spoolsv.exe
2744	explorer.exe
2744	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2744	2012	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe	28
PID 2012 wrote to memory of 2744	2012	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe	28
PID 2012 wrote to memory of 2744	2012	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe	28
PID 2012 wrote to memory of 2744	2012	bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe	28
PID 2744 wrote to memory of 2652	2744	explorer.exe	29
PID 2744 wrote to memory of 2652	2744	explorer.exe	29
PID 2744 wrote to memory of 2652	2744	explorer.exe	29
PID 2744 wrote to memory of 2652	2744	explorer.exe	29
PID 2652 wrote to memory of 2452	2652	spoolsv.exe	30
PID 2652 wrote to memory of 2452	2652	spoolsv.exe	30
PID 2652 wrote to memory of 2452	2652	spoolsv.exe	30
PID 2652 wrote to memory of 2452	2652	spoolsv.exe	30
PID 2452 wrote to memory of 2640	2452	svchost.exe	31
PID 2452 wrote to memory of 2640	2452	svchost.exe	31
PID 2452 wrote to memory of 2640	2452	svchost.exe	31
PID 2452 wrote to memory of 2640	2452	svchost.exe	31
PID 2452 wrote to memory of 2804	2452	svchost.exe	32
PID 2452 wrote to memory of 2804	2452	svchost.exe	32
PID 2452 wrote to memory of 2804	2452	svchost.exe	32
PID 2452 wrote to memory of 2804	2452	svchost.exe	32
PID 2452 wrote to memory of 840	2452	svchost.exe	36
PID 2452 wrote to memory of 840	2452	svchost.exe	36
PID 2452 wrote to memory of 840	2452	svchost.exe	36
PID 2452 wrote to memory of 840	2452	svchost.exe	36
PID 2452 wrote to memory of 2128	2452	svchost.exe	38
PID 2452 wrote to memory of 2128	2452	svchost.exe	38
PID 2452 wrote to memory of 2128	2452	svchost.exe	38
PID 2452 wrote to memory of 2128	2452	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe
"C:\Users\Admin\AppData\Local\Temp\bb05144be48d0eccf2c4908592ce5778c2ab80c7b88142fbf726bc301da9e336.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2744
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2804
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:840
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
80dc9eb4630fb59e2f3f4117858752ae

SHA1
34574b24c76586c483a17a47ed393a5368d12cc6

SHA256
35a156752567397725b31a4578885029086171969cd89a6cfa93e5f6084c568e

SHA512
1d2ecec33209786b99e34f7a4c627aea4242a57ac35e1a28332d2de83bfaeb1835f7c9ebe6fb15923161b5411cda2a4e00406bce59a3576936684706256be007

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
6aab8dd8c9b6cd4c1c302f6e61c71f88

SHA1
c3ca610de17a65548c17163f762f7ead46316c68

SHA256
48665e3d451bb5cb5d2649063160bfeeb9bbe92111e552ce2e29d03987b3545e

SHA512
5f3c401b4b1b05385fbf047ab2d8cc383283be30e91184d891a70589caf228e493690628a6fe0f4a196d942ae24fbdc3b927e36e445f7ee48943285126901e91

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
8e1ff3cfa068705c9c2c126140a3e0c9

SHA1
63b0821427aa2374099b6a9b959468fd71f79dee

SHA256
5875f8fb2dc0bad106736c379a386568b2a414aafeb56a350dfac4d9a8bf5eeb

SHA512
17a2c4cea2dea312c340bc46f4de3cb21d734bc6754a8a420ea3a3dadc1cccc466ed2d8884ce0028a66fb7ef0c668689daf435e7f203df423151481083e4973e

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
8a8f37d5947745445fa9f697886f146e

SHA1
e8ce74dfa73932f1c0bc7e4d547655b91639e0fb

SHA256
964f012a545878463043539469993f508c35f8ec2e3db1341285a31ec32dbb80

SHA512
fda6017ffbc32d82272b96cd78cafce1df5335b1e3ed007d018ccc4a0af2e6e20784d4c411903e474b63d3433629b69b699e279271a3bbe3cedcb351516b7e4c

Download Submit
memory/2012-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2012-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2012-17-0x0000000002810000-0x0000000002841000-memory.dmp

Filesize
196KB

Download
memory/2012-64-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2012-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2012-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2012-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2012-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2012-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2452-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2452-53-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2452-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2452-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2452-63-0x00000000004C0000-0x00000000004F1000-memory.dmp

Filesize
196KB

Download
memory/2640-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2640-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2652-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2652-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2652-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2652-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2744-35-0x00000000027A0000-0x00000000027D1000-memory.dmp

Filesize
196KB

Download
memory/2744-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2744-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2744-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2744-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2744-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download