65b6f87a38cea044dab09d69ee2a2991d281a05cf8c1a584a8b03d7f4ce751c6

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c01f0a704820ff5d60cc199ab658d890N.exe
Size

274KB
MD5

c01f0a704820ff5d60cc199ab658d890
SHA1

3d714eb21bdc6a3441aa995a55ac87f1835f569c
SHA256

65b6f87a38cea044dab09d69ee2a2991d281a05cf8c1a584a8b03d7f4ce751c6
SHA512

f8eb2d125b91d5ac63a9da7cd26363004982c5da98562e3cf805acf99f5716f4e5a15281d6355753df94535672c13d4690434d1db75238d3a8a4c671c3da54f5
SSDEEP

6144:FvEN2U+T6i5LirrllHy4HUcMQY6CbThVcHS:lENN+T5xYrllrU7QY6kThp

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2056	explorer.exe
3984	spoolsv.exe
4244	svchost.exe
2352	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	c01f0a704820ff5d60cc199ab658d890N.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c01f0a704820ff5d60cc199ab658d890N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4920	c01f0a704820ff5d60cc199ab658d890N.exe
4920	c01f0a704820ff5d60cc199ab658d890N.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe
2056	explorer.exe
2056	explorer.exe
4244	svchost.exe
4244	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2056	explorer.exe
4244	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4920	c01f0a704820ff5d60cc199ab658d890N.exe
4920	c01f0a704820ff5d60cc199ab658d890N.exe
2056	explorer.exe
2056	explorer.exe
3984	spoolsv.exe
3984	spoolsv.exe
4244	svchost.exe
4244	svchost.exe
2352	spoolsv.exe
2352	spoolsv.exe
2056	explorer.exe
2056	explorer.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2056	4920	c01f0a704820ff5d60cc199ab658d890N.exe	85
PID 4920 wrote to memory of 2056	4920	c01f0a704820ff5d60cc199ab658d890N.exe	85
PID 4920 wrote to memory of 2056	4920	c01f0a704820ff5d60cc199ab658d890N.exe	85
PID 2056 wrote to memory of 3984	2056	explorer.exe	86
PID 2056 wrote to memory of 3984	2056	explorer.exe	86
PID 2056 wrote to memory of 3984	2056	explorer.exe	86
PID 3984 wrote to memory of 4244	3984	spoolsv.exe	87
PID 3984 wrote to memory of 4244	3984	spoolsv.exe	87
PID 3984 wrote to memory of 4244	3984	spoolsv.exe	87
PID 4244 wrote to memory of 2352	4244	svchost.exe	89
PID 4244 wrote to memory of 2352	4244	svchost.exe	89
PID 4244 wrote to memory of 2352	4244	svchost.exe	89
PID 4244 wrote to memory of 552	4244	svchost.exe	90
PID 4244 wrote to memory of 552	4244	svchost.exe	90
PID 4244 wrote to memory of 552	4244	svchost.exe	90
PID 4244 wrote to memory of 4976	4244	svchost.exe	105
PID 4244 wrote to memory of 4976	4244	svchost.exe	105
PID 4244 wrote to memory of 4976	4244	svchost.exe	105

C:\Users\Admin\AppData\Local\Temp\c01f0a704820ff5d60cc199ab658d890N.exe
"C:\Users\Admin\AppData\Local\Temp\c01f0a704820ff5d60cc199ab658d890N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2056
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2352
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:36 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:552
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
274KB

MD5
102082a1aa7b2a43dfe2c1f624b2dd51

SHA1
382de8dfdbab30ffa05ca4facdb474f1b2fcd4c6

SHA256
cc4463cfe41d99314a59dc0d4c421a7e8e13e5d54ba61542ad0dec5a420ce02c

SHA512
f7513b1b77579b01010a162cdb05e2a1aaed54442df470611ec4d3f40df4753ebc784b1962b7a837647f83bd39e5f9242c9fca173b531621244b9cad595eb4b5

Download Submit
C:\Windows\System\explorer.exe

Filesize
274KB

MD5
808d7bff1e2b9ab0cc495d8eef96a234

SHA1
5171dc8cf61f43f4856db84770c255530c167bb7

SHA256
c6608cb72c3bd32ab7abcc0bfa52d6e81e8d31750d51bb56ded21521900e8d1c

SHA512
e067290011d70251beafa63d6114def2e294d426a9e9aaa25a4b2865a629a0c575feddc3fca0d2fad7ab58473f226712c62279cbf5c76463f9b1dae77f79011d

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
274KB

MD5
a5de9673b557373e3d40bc3afb2e6e2a

SHA1
1e882e2297f3716703f3c69c0fd252b7833ee553

SHA256
ddbacb627d200fffa4102cdd5d0aa295d2ceacdc722f44355e77b824d9353fe1

SHA512
59e7f59ebc317e6c26e579476acf0f67c289ec24a5cd22d0150f761182bda876ffb977a1d5a5a9517d90c6f8361ed5806f4a3a559ec9c6145133296a97e51bcf

Download Submit
C:\Windows\System\svchost.exe

Filesize
274KB

MD5
130b0b0b5438b380742976b3f0026d8b

SHA1
036d90d750246fe44289fac5ad45e91c55d420cb

SHA256
1059c465d073edd4ee030225cd45e23e14aa5711c7cb6ffed8e5b4f10db6de25

SHA512
acb3ba2a6d3f16b42dc8736673563280eebf84fd440f5ff8e9d6f8c2a17ff87346a5aa85bbf42624bb288bd204156831a6d6fcf43a9436bda4c3004da0a5ceba

Download Submit