66299b2a4a65cec262355fd31e4910a30b7e21df5b089a9182da45249c23ce9c

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
Size

1.4MB
MD5

7f16a724a0c8399c9ce8cd4a0a21eab0
SHA1

1aaf1b9cd83067904c7cb023e6bc353ecff50f69
SHA256

66299b2a4a65cec262355fd31e4910a30b7e21df5b089a9182da45249c23ce9c
SHA512

d19f4409ad864cbaf2b0e1bd13d505243dc7c5504cd5201bc973b56de0be76f45b0368841a944f30b7758e6f597fb0d1dcb7564420396a79fdb1efae278bd038
SSDEEP

24576:S9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMV:S9UX1uBx4mYo83vOSeyeaKrT

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
372	explorer.exe
2908	spoolsv.exe
404	svchost.exe
2912	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 28 IoCs

pid	Process
4192	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
372	explorer.exe
2908	spoolsv.exe
404	svchost.exe
2912	spoolsv.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4192	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
4192	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
404	svchost.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
404	svchost.exe
372	explorer.exe
372	explorer.exe
404	svchost.exe
404	svchost.exe
372	explorer.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
404	svchost.exe
404	svchost.exe
372	explorer.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
372	explorer.exe
404	svchost.exe
404	svchost.exe
404	svchost.exe
372	explorer.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
372	explorer.exe
404	svchost.exe
404	svchost.exe
404	svchost.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
404	svchost.exe
372	explorer.exe
404	svchost.exe
404	svchost.exe
372	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
372	explorer.exe
404	svchost.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4192	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
4192	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
4192	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
372	explorer.exe
372	explorer.exe
372	explorer.exe
2908	spoolsv.exe
2908	spoolsv.exe
2908	spoolsv.exe
404	svchost.exe
404	svchost.exe
404	svchost.exe
2912	spoolsv.exe
2912	spoolsv.exe
2912	spoolsv.exe
372	explorer.exe
372	explorer.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 372	4192	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe	92
PID 4192 wrote to memory of 372	4192	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe	92
PID 4192 wrote to memory of 372	4192	7f16a724a0c8399c9ce8cd4a0a21eab0N.exe	92
PID 372 wrote to memory of 2908	372	explorer.exe	94
PID 372 wrote to memory of 2908	372	explorer.exe	94
PID 372 wrote to memory of 2908	372	explorer.exe	94
PID 2908 wrote to memory of 404	2908	spoolsv.exe	95
PID 2908 wrote to memory of 404	2908	spoolsv.exe	95
PID 2908 wrote to memory of 404	2908	spoolsv.exe	95
PID 404 wrote to memory of 2912	404	svchost.exe	96
PID 404 wrote to memory of 2912	404	svchost.exe	96
PID 404 wrote to memory of 2912	404	svchost.exe	96
PID 404 wrote to memory of 4932	404	svchost.exe	97
PID 404 wrote to memory of 4932	404	svchost.exe	97
PID 404 wrote to memory of 4932	404	svchost.exe	97
PID 404 wrote to memory of 2596	404	svchost.exe	110
PID 404 wrote to memory of 2596	404	svchost.exe	110
PID 404 wrote to memory of 2596	404	svchost.exe	110

C:\Users\Admin\AppData\Local\Temp\7f16a724a0c8399c9ce8cd4a0a21eab0N.exe
"C:\Users\Admin\AppData\Local\Temp\7f16a724a0c8399c9ce8cd4a0a21eab0N.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:372
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2912
    - - C:\Windows\SysWOW64\at.exe
        
        at 10:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
    - - C:\Windows\SysWOW64\at.exe
        
        at 10:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4444,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
1.4MB

MD5
ea503980a8583b95935412c121b2b7b4

SHA1
9413d5beb8deddc45e0298066aa4a2abe7948ba9

SHA256
62a2fa41d5700d91f1c388c706ed24de897a73489bf0008337c0d1d2c25ec036

SHA512
c7b7f691c9a84b7cf87affb2b4cadfe5e1feb885619f96387d2dbc4b0b60028040f96d71be0f2fed94d4265bf0a9faf129b755e0b6c4a9d40d86118b84ef4840

Download Submit
C:\Windows\System\explorer.exe

Filesize
1.4MB

MD5
6a009c05e7c169a190f7debadce61ec8

SHA1
249ff929e527ab09c9f155afcf398dc3cf98cbcd

SHA256
5306aa1e22a13a84515de101e2c7020bb7de12e4e23e53a55a97b807d338b7c9

SHA512
49c9bfa2ef476ca959fe959d1dc04f1ce0fd09556dc67bcffb4958308c7cb826ea7e08f95c8bb0f37d017d04f9cca425486d968fbb0fcbc9423b8b1c3143855d

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
1.4MB

MD5
53f1a1d3579977dcfddebdfaa23c1d7c

SHA1
9815cbfa3eaec42b4ea7f0222bbcda684a442511

SHA256
57b75c5acbb23164f25da4bb4235a49923a318cff75e056d93b928275d0a9ef0

SHA512
f0f8732f1e50cad1f492b90130f24aa22b794b8e62986722e6f3ea377aec92abf05804bcc2577889107e4bb33c88cbde49bbe40f8981a3de38ecb501efa7d9e7

Download Submit
C:\Windows\System\svchost.exe

Filesize
1.4MB

MD5
8a223817e4a13d449d1ab2c2947baee3

SHA1
dd3995b3935b6a14cce56f9170900c8171ed7540

SHA256
baf096b8df5d44f562290f1fe615a398ecabcdb1e28204d94f95e9ba8f7f05d6

SHA512
03a6e3305bef33496eed0718c9c9eab568cf44f11627987c4bfe304208680ed43ce43dda40fc090b7ff71b212023b78d8cbea7d4b5cf0356a0d262d7570a43a6

Download Submit
memory/372-42-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download
memory/372-56-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download
memory/404-25-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download
memory/404-44-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download
memory/404-45-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download
memory/2908-38-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download
memory/2912-30-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download
memory/2912-34-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download
memory/4192-40-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download
memory/4192-0-0x0000000000400000-0x00000000009A0000-memory.dmp

Filesize
5.6MB

Download