Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 06:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9dddd29f3cc474a5141336c2ffd75c0N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
b9dddd29f3cc474a5141336c2ffd75c0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
120 seconds
General
-
Target
b9dddd29f3cc474a5141336c2ffd75c0N.exe
-
Size
206KB
-
MD5
b9dddd29f3cc474a5141336c2ffd75c0
-
SHA1
8ed739b24f51163b76495b6aeb621132e53af986
-
SHA256
762f21a26e15ff6be193236b2e90c7a520884853ac8f407f6f92b3386d894aa8
-
SHA512
45c8b41dc8886e469b4d34976e30b8fbd7f4c4d465aa070cb6bdadcbba2b43e75cedf019404467b8edb7a6328ddd3dcae982d79c1792c5403354bb6617b5a63b
-
SSDEEP
3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unB:zvEN2U+T6i5LirrllHy4HUcMQY6E
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 3064 explorer.exe 768 spoolsv.exe 2748 svchost.exe 2084 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 2860 b9dddd29f3cc474a5141336c2ffd75c0N.exe 2860 b9dddd29f3cc474a5141336c2ffd75c0N.exe 3064 explorer.exe 3064 explorer.exe 768 spoolsv.exe 768 spoolsv.exe 2748 svchost.exe 2748 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b9dddd29f3cc474a5141336c2ffd75c0N.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9dddd29f3cc474a5141336c2ffd75c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2860 b9dddd29f3cc474a5141336c2ffd75c0N.exe 3064 explorer.exe 3064 explorer.exe 3064 explorer.exe 2748 svchost.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe 3064 explorer.exe 2748 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3064 explorer.exe 2748 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2860 b9dddd29f3cc474a5141336c2ffd75c0N.exe 2860 b9dddd29f3cc474a5141336c2ffd75c0N.exe 3064 explorer.exe 3064 explorer.exe 768 spoolsv.exe 768 spoolsv.exe 2748 svchost.exe 2748 svchost.exe 2084 spoolsv.exe 2084 spoolsv.exe 3064 explorer.exe 3064 explorer.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2860 wrote to memory of 3064 2860 b9dddd29f3cc474a5141336c2ffd75c0N.exe 30 PID 2860 wrote to memory of 3064 2860 b9dddd29f3cc474a5141336c2ffd75c0N.exe 30 PID 2860 wrote to memory of 3064 2860 b9dddd29f3cc474a5141336c2ffd75c0N.exe 30 PID 2860 wrote to memory of 3064 2860 b9dddd29f3cc474a5141336c2ffd75c0N.exe 30 PID 3064 wrote to memory of 768 3064 explorer.exe 31 PID 3064 wrote to memory of 768 3064 explorer.exe 31 PID 3064 wrote to memory of 768 3064 explorer.exe 31 PID 3064 wrote to memory of 768 3064 explorer.exe 31 PID 768 wrote to memory of 2748 768 spoolsv.exe 32 PID 768 wrote to memory of 2748 768 spoolsv.exe 32 PID 768 wrote to memory of 2748 768 spoolsv.exe 32 PID 768 wrote to memory of 2748 768 spoolsv.exe 32 PID 2748 wrote to memory of 2084 2748 svchost.exe 33 PID 2748 wrote to memory of 2084 2748 svchost.exe 33 PID 2748 wrote to memory of 2084 2748 svchost.exe 33 PID 2748 wrote to memory of 2084 2748 svchost.exe 33 PID 2748 wrote to memory of 2804 2748 svchost.exe 34 PID 2748 wrote to memory of 2804 2748 svchost.exe 34 PID 2748 wrote to memory of 2804 2748 svchost.exe 34 PID 2748 wrote to memory of 2804 2748 svchost.exe 34 PID 2748 wrote to memory of 1900 2748 svchost.exe 37 PID 2748 wrote to memory of 1900 2748 svchost.exe 37 PID 2748 wrote to memory of 1900 2748 svchost.exe 37 PID 2748 wrote to memory of 1900 2748 svchost.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9dddd29f3cc474a5141336c2ffd75c0N.exe"C:\Users\Admin\AppData\Local\Temp\b9dddd29f3cc474a5141336c2ffd75c0N.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2084
-
-
C:\Windows\SysWOW64\at.exeat 06:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2804
-
-
C:\Windows\SysWOW64\at.exeat 06:51 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:1900
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD56b3d2eefb4de747e91dde8330a5394c7
SHA1ec5a77916ad1d225a7edc35446f1ccb01ea583d5
SHA2563d0378dc365811d548ae640e9f2f1233fc0f0cfe6f1fdcb766d61e2addc010e2
SHA51284b0e9341def274bfb9be5312f47c4cdbfbc13c96c9dfdd179369b31c20dd3c689750f9770cd686d28fe1ce677596fd460dd6020d1384aebe2eee80ece9c84d9
-
Filesize
206KB
MD59b97074c6987cc5f83b8261a42747b7a
SHA1429b58fde4bb5d6667c1be5e8cd82c09e736dc38
SHA2569c0d3583dd95029399fcf8ea4808bf4d6e36a1691c2cf517adfbf58cf8661e26
SHA51203c82bb4153a976c297e6b035d9b47c31d0f9679f4d38b92dbbd993ffc8be2773fcde82b206f2ad015fbd26eb3ee407f8bcf10a634805dbbc82477e35bcf9586
-
Filesize
206KB
MD585274ad984012cefc093713d76cbbaa6
SHA173b224565073089054040f8da3e702dae9a93b2b
SHA256bb130243c9cb2239c2df2dc42ba4913bbb414da08eb60342f1c81f3cbb2fe86b
SHA512e256397e7c925b299b98d6f04bee3a50e25583af176dd192bef5eb48d1e73c541c7ef1bded2f4d0ba5c7871e1f6f67d4208727c00f6817949519e2a5993c2cb8
-
Filesize
206KB
MD5641e93424e65f261ae9c876f9c68c4e6
SHA12c52436857eb8ea3ed27f62ad806fcb26ce49d61
SHA256f3557f41c9791ebe713645a7a4ed811ab531a5300f193a18d1caf7d75e5873d3
SHA5125c6008ca6800cbd1c5956fd38ecb4a725796219389644ec507f2262a33e6c5d3cfeed0f6c476503735f01c8bb8463825dbad58f0c21c5e025c582339a17be34e