Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 21:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b9508e08db808c9c6dee5083eec0910N.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
5b9508e08db808c9c6dee5083eec0910N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
12 signatures
120 seconds
General
-
Target
5b9508e08db808c9c6dee5083eec0910N.exe
-
Size
206KB
-
MD5
5b9508e08db808c9c6dee5083eec0910
-
SHA1
dafc2cecf3bcbcca2128aedd938257cd1e7e6f8f
-
SHA256
36d09b7ce5afa1d5c7865b2474c4a9188ced996578d5118eb1764fd2e24dc485
-
SHA512
f2aa9f886e77952bb84fc69dd6511b1d395e8243e54a7c17dc4400a4fd68a9da318d8e1bc91b38f8cb2cd868b7fcafc85bf0cfd38426b434c12805faf52efe69
-
SSDEEP
6144:zvEN2U+T6i5LirrllHy4HUcMQY6xUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUH:zENN+T5xYrllrU7QY6q
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 788 explorer.exe 1972 spoolsv.exe 2744 svchost.exe 2872 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 1488 5b9508e08db808c9c6dee5083eec0910N.exe 1488 5b9508e08db808c9c6dee5083eec0910N.exe 788 explorer.exe 788 explorer.exe 1972 spoolsv.exe 1972 spoolsv.exe 2744 svchost.exe 2744 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 5b9508e08db808c9c6dee5083eec0910N.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5b9508e08db808c9c6dee5083eec0910N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1488 5b9508e08db808c9c6dee5083eec0910N.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 2744 svchost.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe 788 explorer.exe 2744 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 788 explorer.exe 2744 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1488 5b9508e08db808c9c6dee5083eec0910N.exe 1488 5b9508e08db808c9c6dee5083eec0910N.exe 788 explorer.exe 788 explorer.exe 1972 spoolsv.exe 1972 spoolsv.exe 2744 svchost.exe 2744 svchost.exe 2872 spoolsv.exe 2872 spoolsv.exe 788 explorer.exe 788 explorer.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1488 wrote to memory of 788 1488 5b9508e08db808c9c6dee5083eec0910N.exe 30 PID 1488 wrote to memory of 788 1488 5b9508e08db808c9c6dee5083eec0910N.exe 30 PID 1488 wrote to memory of 788 1488 5b9508e08db808c9c6dee5083eec0910N.exe 30 PID 1488 wrote to memory of 788 1488 5b9508e08db808c9c6dee5083eec0910N.exe 30 PID 788 wrote to memory of 1972 788 explorer.exe 31 PID 788 wrote to memory of 1972 788 explorer.exe 31 PID 788 wrote to memory of 1972 788 explorer.exe 31 PID 788 wrote to memory of 1972 788 explorer.exe 31 PID 1972 wrote to memory of 2744 1972 spoolsv.exe 32 PID 1972 wrote to memory of 2744 1972 spoolsv.exe 32 PID 1972 wrote to memory of 2744 1972 spoolsv.exe 32 PID 1972 wrote to memory of 2744 1972 spoolsv.exe 32 PID 2744 wrote to memory of 2872 2744 svchost.exe 33 PID 2744 wrote to memory of 2872 2744 svchost.exe 33 PID 2744 wrote to memory of 2872 2744 svchost.exe 33 PID 2744 wrote to memory of 2872 2744 svchost.exe 33 PID 2744 wrote to memory of 2832 2744 svchost.exe 34 PID 2744 wrote to memory of 2832 2744 svchost.exe 34 PID 2744 wrote to memory of 2832 2744 svchost.exe 34 PID 2744 wrote to memory of 2832 2744 svchost.exe 34 PID 2744 wrote to memory of 2668 2744 svchost.exe 37 PID 2744 wrote to memory of 2668 2744 svchost.exe 37 PID 2744 wrote to memory of 2668 2744 svchost.exe 37 PID 2744 wrote to memory of 2668 2744 svchost.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b9508e08db808c9c6dee5083eec0910N.exe"C:\Users\Admin\AppData\Local\Temp\5b9508e08db808c9c6dee5083eec0910N.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
C:\Windows\SysWOW64\at.exeat 21:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
C:\Windows\SysWOW64\at.exeat 21:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD53bbd3cf16a858dc6d2edfc096868c29c
SHA133b6f9b8faf8f48dddb4a8709f44831fec9992f1
SHA256ab11c4242a0abce2feb649bb1ab2ee5a6f164b089177f5db0d63a538a4374baa
SHA512eb06e68d12afcbdb3c45b22056f2a13c4d14a466dad179be7b9b52e107b140fa901657d13402f43d480f67ed8a40de32d5de86f1fa1a1a3735c81447c974efbf
-
Filesize
206KB
MD5d3fe2466313084a2bbbbe58c91b963b0
SHA102ed2358e0ce42c8432249987164fea31b44ac82
SHA256bc332b6ee5baa72bcde01a2733cf6b8419a09b9a14b4b2be9f781186ad04eb4a
SHA51227e852aeb91f2294950d372b98058043cb17deb24167284215705cb14dbd9728f6a3360bdc56cc60efa1d45ccc45dc93fed5af7415af34817302e22c03ec8346
-
Filesize
206KB
MD56bb3193c48d7a5d869638b89f3aa90b4
SHA116f8326a7e8f1b2bb37fc82b1721680664e39f2e
SHA2565e6983d108016573dcfe03a595b2097fc5179dd9f879ff09d9c793fe71c56eb2
SHA51246a2d2682af2952653647f6b3995b65e78c1661c674d1878b04c312b6cd91c0d565b19c630fefa6df9ed0e8d8a2addcc14bdd353eabe0cf9a1e41336e46975e4
-
Filesize
206KB
MD50fc6850d1cb214be2a4fcd5fc66318ac
SHA1437e4fb6d874361ee9094c3f867cdc27e147cc80
SHA2569e2ea9623e9e6a02cbf5b7ac78ddc34774249d54cdfde3196ff2e76ed2f62203
SHA512269f03721d85c26c260ee240c7c795eea9fd91f6148ad8049369c9bf8cfd50243364cf884d1198a08c0d5321e7eacb6d002dcbcc98257e7414afee13b761e8de