Analysis
- max time kernel
120s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
01/10/2024, 16:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
120 seconds
General
- Target e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe
- Size 206KB
- Sample241001-tzjpssshrb
- SHA256 e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2
- MD5 d8c205bf78e6d2a89868bd72e2232f90
- SHA1 09cc69f00206446b4e03367f2096697badf02c1f
- SHA512 dae5f089db94507c4471d0fdc57492cbbb05cea6ea80375a4ad15ecb6f75ae4dee03ff1033aea9cef5f63c5068e899a5805bb5914bb9d40b4c3d03a176236bdf
- SSDEEP 3072:MvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unX:MvEN2U+T6i5LirrllHy4HUcMQY6w
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 1328 explorer.exe 4860 spoolsv.exe 4744 svchost.exe 3084 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5088 e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe 5088 e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe 1328 explorer.exe 1328 explorer.exe 1328 explorer.exe 1328 explorer.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe 1328 explorer.exe 1328 explorer.exe 4744 svchost.exe 4744 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1328 explorer.exe 4744 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 5088 e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe 5088 e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe 1328 explorer.exe 1328 explorer.exe 4860 spoolsv.exe 4860 spoolsv.exe 4744 svchost.exe 4744 svchost.exe 3084 spoolsv.exe 3084 spoolsv.exe 1328 explorer.exe 1328 explorer.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5088 wrote to memory of 1328 5088 e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe 82 PID 5088 wrote to memory of 1328 5088 e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe 82 PID 5088 wrote to memory of 1328 5088 e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe 82 PID 1328 wrote to memory of 4860 1328 explorer.exe 83 PID 1328 wrote to memory of 4860 1328 explorer.exe 83 PID 1328 wrote to memory of 4860 1328 explorer.exe 83 PID 4860 wrote to memory of 4744 4860 spoolsv.exe 84 PID 4860 wrote to memory of 4744 4860 spoolsv.exe 84 PID 4860 wrote to memory of 4744 4860 spoolsv.exe 84 PID 4744 wrote to memory of 3084 4744 svchost.exe 85 PID 4744 wrote to memory of 3084 4744 svchost.exe 85 PID 4744 wrote to memory of 3084 4744 svchost.exe 85 PID 4744 wrote to memory of 4868 4744 svchost.exe 86 PID 4744 wrote to memory of 4868 4744 svchost.exe 86 PID 4744 wrote to memory of 4868 4744 svchost.exe 86 PID 4744 wrote to memory of 2068 4744 svchost.exe 97 PID 4744 wrote to memory of 2068 4744 svchost.exe 97 PID 4744 wrote to memory of 2068 4744 svchost.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe"C:\Users\Admin\AppData\Local\Temp\e7a221ac207394cc27e9096b27b952b167b2783cc53ac63a687c82987c4d32b2N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3084
-
-
C:\Windows\SysWOW64\at.exeat 16:31 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:4868
-
-
C:\Windows\SysWOW64\at.exeat 16:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2068
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 949208fc099048f458efdeebc84b28c26c70cd0ff22dea01645f776759c52311
- MD5 019681ea384064d77442776c8825062c
- SHA1 f66bc1323c772816817333db75ead4bc25b7e149
- SHA512 bb199cf3bd4cedce3e28942eead04ae126ef656621834b6033ee78507da525bb77907bf190f5eec8bf452b0ecfba71adb49e964c3781f7edb5144779bb8c48cb
- SSDEEP 3072:MvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unwUUUUUUUUUUUUUUUUUUUUUG:MvEN2U+T6i5LirrllHy4HUcMQY6x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 881d921c153ba76b5808478e57ac39117f024cd6b654a5d9b1c19ad9b276e809
- MD5 24d2071ce1ee0bb4252b74a14ea389cd
- SHA1 b250119135d113d4e2d81c562ead693bb4d6debc
- SHA512 5b69fe3f2ae3978b581b9c52e445559abc2e1156bbc0b933960e53b5036108a25c1966303a8c7e0ec769bb3ef29a4b54af2a37cf9350ceb5fdb96a48b56fc545
- SSDEEP 3072:MvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6und:MvEN2U+T6i5LirrllHy4HUcMQY6g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 79b52a0b6bc3b8efd6066d8ba9b0b336827b7788714f04a3549573d0976277ea
- MD5 8d1913dcea34bd7d041c6ea39b81fff9
- SHA1 fd9231927388e0062adffba1c5abc9f78adfe994
- SHA512 d49c132ecff75d3734078aacad7d182f4ef460d99f168dd755fa9ab364e2dfba7264e9d33d1dcf83c0e65a792152bc8c3848b1ca0111dfbd67dc6ec23fd6e41d
- SSDEEP 3072:MvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unk:MvEN2U+T6i5LirrllHy4HUcMQY67
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 1281021516ac3137f674729617aefdf8604851cf07f5bafa355e43e97dce4d9f
- MD5 661dba58e23eac71c7c982f7716fc86d
- SHA1 ee5bc54a0b694bfd389b57f4101933a46bbec2e4
- SHA512 f9eb8832f31a116c680641ad8201f638c9771f7118ea7954a938629b1781292c0b7cf89c2be68f2884d83e799f5587ccfec9e813ed33be543c3ddd23036661a5
- SSDEEP 3072:MvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unJ:MvEN2U+T6i5LirrllHy4HUcMQY6c
- MD5 SHA1 SHA512 SSDEEP