Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe
-
Size
207KB
-
MD5
1da17e9ebf0dbc9cca47040e4ffd51c0
-
SHA1
84e292e82c91fcb355c9de36a6dc43762c63082c
-
SHA256
763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b
-
SHA512
ae8d511b4dd24c7c5bb6f322e6726af929c8c3dc8c697a98ae81fa5835ec53dc9b53433fb445f01f949bb3cd4dd1a34aa3634b971eb2c7b91be835ee8d78d7a8
-
SSDEEP
6144:zvEN2U+T6i5LirrllHy4HUcMQY6yQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQX:zENN+T5xYrllrU7QY6h
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 1640 explorer.exe 2612 spoolsv.exe 3012 svchost.exe 3020 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 288 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe 288 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe 1640 explorer.exe 1640 explorer.exe 2612 spoolsv.exe 2612 spoolsv.exe 3012 svchost.exe 3012 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 288 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 3012 svchost.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe 1640 explorer.exe 3012 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1640 explorer.exe 3012 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 288 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe 288 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe 1640 explorer.exe 1640 explorer.exe 2612 spoolsv.exe 2612 spoolsv.exe 3012 svchost.exe 3012 svchost.exe 3020 spoolsv.exe 3020 spoolsv.exe 1640 explorer.exe 1640 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 288 wrote to memory of 1640 288 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe 30 PID 288 wrote to memory of 1640 288 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe 30 PID 288 wrote to memory of 1640 288 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe 30 PID 288 wrote to memory of 1640 288 763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe 30 PID 1640 wrote to memory of 2612 1640 explorer.exe 31 PID 1640 wrote to memory of 2612 1640 explorer.exe 31 PID 1640 wrote to memory of 2612 1640 explorer.exe 31 PID 1640 wrote to memory of 2612 1640 explorer.exe 31 PID 2612 wrote to memory of 3012 2612 spoolsv.exe 32 PID 2612 wrote to memory of 3012 2612 spoolsv.exe 32 PID 2612 wrote to memory of 3012 2612 spoolsv.exe 32 PID 2612 wrote to memory of 3012 2612 spoolsv.exe 32 PID 3012 wrote to memory of 3020 3012 svchost.exe 33 PID 3012 wrote to memory of 3020 3012 svchost.exe 33 PID 3012 wrote to memory of 3020 3012 svchost.exe 33 PID 3012 wrote to memory of 3020 3012 svchost.exe 33 PID 3012 wrote to memory of 2720 3012 svchost.exe 34 PID 3012 wrote to memory of 2720 3012 svchost.exe 34 PID 3012 wrote to memory of 2720 3012 svchost.exe 34 PID 3012 wrote to memory of 2720 3012 svchost.exe 34 PID 3012 wrote to memory of 2592 3012 svchost.exe 36 PID 3012 wrote to memory of 2592 3012 svchost.exe 36 PID 3012 wrote to memory of 2592 3012 svchost.exe 36 PID 3012 wrote to memory of 2592 3012 svchost.exe 36 PID 3012 wrote to memory of 1084 3012 svchost.exe 38 PID 3012 wrote to memory of 1084 3012 svchost.exe 38 PID 3012 wrote to memory of 1084 3012 svchost.exe 38 PID 3012 wrote to memory of 1084 3012 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe"C:\Users\Admin\AppData\Local\Temp\763aae1f3ae133bb55560ef85dee3ec87263df8232f95c213c1c5e0f6c11c77b.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
C:\Windows\SysWOW64\at.exeat 22:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2720
-
-
C:\Windows\SysWOW64\at.exeat 22:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2592
-
-
C:\Windows\SysWOW64\at.exeat 22:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:1084
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5956eba15c2b5c1d3c0fa60d029bf0913
SHA146f235174b04964ebdf4de459cf736b871089d22
SHA256c52b1521eeb67bc884609fdfce99c49ba49ceecd00b9c5108134fb22c191749f
SHA512c86d9c76fd48bb0f12580182e9ce97b6c0baeff3cc77e2a06d0b4dd7f773a604b5d259fb61e120da658366ec51224bbd94326773d0027c1d05d8235f0b9d806e
-
Filesize
207KB
MD593808c607c669f6eeefb93af4f71e5b7
SHA1b63bdcbbec5bf158f62e85153ce90608eef0c569
SHA25618d97e1945baf8dcd43e902dff62f5a22aea671616bd2b019b65942c0c27c4f9
SHA5127180d0ed9fb6d1350adb618cb830d156c5829f0ee939c92736ede93360ed8333d489749aaf354ebd137ca1de87e4f1ea64195b7e775679811892776118e42980
-
Filesize
206KB
MD5ed61841252f450a055858377ea509b5d
SHA1114ffdfe69c0336f666dad4f926959c7ce207a41
SHA2565e1365a0f852028f5b77fb7db1b49e1d25e437518ae18760784c83b114c8576e
SHA51226ae3300bccb9465372a769e2d18cf61dbc9f544e7e75a41c4938960dfed2b54e96119477bc532f55a1004adf29cb3fe1101808d672b74355ac559f909d62ace
-
Filesize
206KB
MD5e75ff56ba9715375b5020950cf6651b1
SHA17f98996a6dba3344601ebdf3bfc37e3d4e0771f8
SHA2562a91a93f8c752cee9b49ca31ffdfc057e5d85e41fb561d4fe357990bde845ab0
SHA5126df5f3f6c36844d33656b3afb4d56c17e4853a481f4f110531c812538c0e4eb23276eccf26d3dfa6c9e1ead4ecf974c2b805085694413bca46b0374e80aa5ac9