351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36

Analysis

max time kernel
150s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe
Size

67KB
MD5

4851fb73dd894ee82629bc373f8697b3
SHA1

93599608bfe3fdf39b98d854a307b927ef59b5ff
SHA256

351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36
SHA512

c672f1b2f84ad26a7ba27b59b741e15e476588cc09ac711b4b5c280c567150a1c8de3854903d29da80000918d5831598d1a7fcab565748bfa611b0eb7886ee2e
SSDEEP

1536:EgXsfgWQN1kYsRxWTg3PwSWe991Rdolpdz6JAkA4lllllllllllllllllllllllp:1tWYfGATvPe9slp+ApK

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2780	explorer.exe
896	spoolsv.exe
2548	svchost.exe
1532	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2380	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe
2380	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe
2780	explorer.exe
2780	explorer.exe
896	spoolsv.exe
896	spoolsv.exe
2548	svchost.exe
2548	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2380	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe
2780	explorer.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe
2780	explorer.exe
2548	svchost.exe
2780	explorer.exe
2548	svchost.exe
2548	svchost.exe
2780	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2548	svchost.exe
2780	explorer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2380	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe
2380	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe
2780	explorer.exe
2780	explorer.exe
896	spoolsv.exe
896	spoolsv.exe
2548	svchost.exe
2548	svchost.exe
1532	spoolsv.exe
1532	spoolsv.exe
2780	explorer.exe
2780	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2780	2380	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe	30
PID 2380 wrote to memory of 2780	2380	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe	30
PID 2380 wrote to memory of 2780	2380	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe	30
PID 2380 wrote to memory of 2780	2380	351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe	30
PID 2780 wrote to memory of 896	2780	explorer.exe	31
PID 2780 wrote to memory of 896	2780	explorer.exe	31
PID 2780 wrote to memory of 896	2780	explorer.exe	31
PID 2780 wrote to memory of 896	2780	explorer.exe	31
PID 896 wrote to memory of 2548	896	spoolsv.exe	32
PID 896 wrote to memory of 2548	896	spoolsv.exe	32
PID 896 wrote to memory of 2548	896	spoolsv.exe	32
PID 896 wrote to memory of 2548	896	spoolsv.exe	32
PID 2548 wrote to memory of 1532	2548	svchost.exe	33
PID 2548 wrote to memory of 1532	2548	svchost.exe	33
PID 2548 wrote to memory of 1532	2548	svchost.exe	33
PID 2548 wrote to memory of 1532	2548	svchost.exe	33
PID 2548 wrote to memory of 3044	2548	svchost.exe	34
PID 2548 wrote to memory of 3044	2548	svchost.exe	34
PID 2548 wrote to memory of 3044	2548	svchost.exe	34
PID 2548 wrote to memory of 3044	2548	svchost.exe	34
PID 2548 wrote to memory of 1956	2548	svchost.exe	36
PID 2548 wrote to memory of 1956	2548	svchost.exe	36
PID 2548 wrote to memory of 1956	2548	svchost.exe	36
PID 2548 wrote to memory of 1956	2548	svchost.exe	36
PID 2548 wrote to memory of 2152	2548	svchost.exe	39
PID 2548 wrote to memory of 2152	2548	svchost.exe	39
PID 2548 wrote to memory of 2152	2548	svchost.exe	39
PID 2548 wrote to memory of 2152	2548	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe
"C:\Users\Admin\AppData\Local\Temp\351565b5605e02bbc53b6b299c1e3eae5eb6340f9d6582674600cc561a16eb36.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2780
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:896
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1532
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
67KB

MD5
1c17508f5673b4d6fcd01036d6aa6146

SHA1
6f505a0925b189523c80236ac12109c30d19e8e2

SHA256
b3edc1c04219c1a93db394213f13adc25e333c7981540daf16ce07939c0248bd

SHA512
a1935f19cd79bf7958c6f4631e40e476b5ebb94189d222db106ca8c534afd4b130567f31a90c4ed2fd6da195b7ba50ea9dd888411743bc5e0a06c4a25bf6cbe1

Download Submit
C:\Windows\system\svchost.exe

Filesize
67KB

MD5
b96087bcc31c6cfb4e19ea48da2502f2

SHA1
ac8e0287c5f2f1a5e34d2d4a4c4a81556cc7bd24

SHA256
511457a928390be990ae6ebf016c4022e2cb1c60adc66cdcdef938a25e651a8a

SHA512
ff35db1721b2d0935c886f8cfed864b9fa28a5b25be14a04629621be82ba0b845a0296eb91676ee789232d7aa0084208a4c02d92a92a40a1d90174ec9cc0a767

Download Submit
\Windows\system\explorer.exe

Filesize
67KB

MD5
50e5cbdffe2fba9419dad065a44033a9

SHA1
689e5349d08b67c2b7918a1516bf0fdc7ee2b1f4

SHA256
565beae3676d52b735e1f928bae1bf7eac7a5755212e88165ded8d2c79ee5902

SHA512
cb74f6a75620b3af8ec9d1cff25644d5350daa1c4e6fde1e4f21e3e6ef3d68a6c6b9b1c66033d0beeeaeb985da0543b08b59499f39dfdcaf03330e5746b8965a

Download Submit
\Windows\system\spoolsv.exe

Filesize
67KB

MD5
b3b0a733a24fa3a726c2f9bf20dacb5b

SHA1
7de5044f656828f394b58cc9e764889f012936d0

SHA256
44bd4dac2fc55423197639cf9b7a13c298cc15d336d335202e472a0e37c9c3ca

SHA512
9c0ca193e7a7524ee0262a0a021749e29914ef28d931cb1be29b59e935477919d0ccd10c94ac899ac0f9d6a74f164d27cfcac36d4549cfdf727a5a68cbeb050f

Download Submit
memory/896-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/896-52-0x00000000031C0000-0x00000000031F1000-memory.dmp

Filesize
196KB

Download
memory/896-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/896-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1532-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1532-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2380-80-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2380-18-0x00000000026D0000-0x0000000002701000-memory.dmp

Filesize
196KB

Download
memory/2380-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2380-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2380-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2380-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2380-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2380-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2380-17-0x00000000026D0000-0x0000000002701000-memory.dmp

Filesize
196KB

Download
memory/2380-53-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2548-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-66-0x0000000001DB0000-0x0000000001DE1000-memory.dmp

Filesize
196KB

Download
memory/2548-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-57-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2548-100-0x0000000001DB0000-0x0000000001DE1000-memory.dmp

Filesize
196KB

Download
memory/2780-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2780-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2780-31-0x0000000003380000-0x00000000033B1000-memory.dmp

Filesize
196KB

Download
memory/2780-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2780-95-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2780-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2780-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download