2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f

General

Target

2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe
Size

206KB
MD5

28458738ba1c9a40fc2a2d52ed94ea6d
SHA1

2cee0297a1575c9b149fb94d9082abe084266983
SHA256

2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f
SHA512

a903141ab0d994c02a3e822c95a12eef01bfcdbacf21c8e43e766145f5d14366c622f924ab6d8fb8597caccb5d3b5db35daf873f1c1d4483cd2efd91f57f686e
SSDEEP

3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un1:zvEN2U+T6i5LirrllHy4HUcMQY6i

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2804 explorer.exe
3040 spoolsv.exe
2560 svchost.exe
2544 spoolsv.exe

pid	process
2804	explorer.exe
3040	spoolsv.exe
2560	svchost.exe
2544	spoolsv.exe

Loads dropped DLL 8 IoCs

Processes:

2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exeexplorer.exespoolsv.exesvchost.exe

pid	process
816	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe
816	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe
2804	explorer.exe
2804	explorer.exe
3040	spoolsv.exe
3040	spoolsv.exe
2560	svchost.exe
2560	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

Processes:

2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exeexplorer.exespoolsv.exesvchost.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

spoolsv.exesvchost.exespoolsv.exeat.exeat.exeat.exe2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exeexplorer.exesvchost.exe

pid	process
816	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe
2804	explorer.exe
2804	explorer.exe
2804	explorer.exe
2560	svchost.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe
2804	explorer.exe
2560	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2804 explorer.exe
2560 svchost.exe

pid	process
2804	explorer.exe
2560	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
816	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe
816	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe
2804	explorer.exe
2804	explorer.exe
3040	spoolsv.exe
3040	spoolsv.exe
2560	svchost.exe
2560	svchost.exe
2544	spoolsv.exe
2544	spoolsv.exe
2804	explorer.exe
2804	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 816 wrote to memory of 2804	816	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe	explorer.exe
PID 816 wrote to memory of 2804	816	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe	explorer.exe
PID 816 wrote to memory of 2804	816	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe	explorer.exe
PID 816 wrote to memory of 2804	816	2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe	explorer.exe
PID 2804 wrote to memory of 3040	2804	explorer.exe	spoolsv.exe
PID 2804 wrote to memory of 3040	2804	explorer.exe	spoolsv.exe
PID 2804 wrote to memory of 3040	2804	explorer.exe	spoolsv.exe
PID 2804 wrote to memory of 3040	2804	explorer.exe	spoolsv.exe
PID 3040 wrote to memory of 2560	3040	spoolsv.exe	svchost.exe
PID 3040 wrote to memory of 2560	3040	spoolsv.exe	svchost.exe
PID 3040 wrote to memory of 2560	3040	spoolsv.exe	svchost.exe
PID 3040 wrote to memory of 2560	3040	spoolsv.exe	svchost.exe
PID 2560 wrote to memory of 2544	2560	svchost.exe	spoolsv.exe
PID 2560 wrote to memory of 2544	2560	svchost.exe	spoolsv.exe
PID 2560 wrote to memory of 2544	2560	svchost.exe	spoolsv.exe
PID 2560 wrote to memory of 2544	2560	svchost.exe	spoolsv.exe
PID 2560 wrote to memory of 2584	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 2584	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 2584	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 2584	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 1508	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 1508	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 1508	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 1508	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 1940	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 1940	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 1940	2560	svchost.exe	at.exe
PID 2560 wrote to memory of 1940	2560	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe
"C:\Users\Admin\AppData\Local\Temp\2a1274a40d58767f3caabf866c034d00fa8c764c5aac8a11b15b8712f51fa32f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2544
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
4dec81fbfd5703184a10481cb7ed046a

SHA1
be2d4252548b165e5bc1fee288c5353f8acbdc6c

SHA256
9f8320e65be9fdfe7dac4f04ad2018c511efbfcc3a718d5202a0519dc114cb92

SHA512
1166f1388cffd2b49c0c1c97c4ebe79a05f1dfd3a11587c72f2fa332c870444de8a8769e6d89779a3f2d878ea261889130b4fa574583a806e865313deb7be3d7

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
bd934f0c3a44376876b9b02ae8394209

SHA1
59e48f3f124613d966b9f1a0ba1a5858ff0b54ac

SHA256
472690134027bc6f98b9524e6fb6d57992067c6123b29830587c4b216a15719a

SHA512
dc0b48e898cefc09c2d17fd4bc28320e743ca4197a983f66ef847768f52149958324304f6180c12e9dd8a5b1365503adf4d5751feaaa394bf0bf6c95b832f3fb

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
1d25c2805dd48110644a3b4179939083

SHA1
93ea2f67f66f7f3710c3362693d3e2d0874f81d2

SHA256
2cf64e07b8e7fdaa82b12333bc017540ff2f333af43891f04e4293c493ad1980

SHA512
ca136da112ed31632dd86739d07cfca7ae594083fe043820185cff265d64c2e1ca33df752f13206f20d102aea87458acc288ff53a1c377239e73c6a403a3f0f8

Download Submit
\Windows\system\svchost.exe

Filesize
206KB

MD5
939230620310c8319341cbf608ff6474

SHA1
5210ae447863a649a35cbba6ef496c49a9af6942

SHA256
2540d3b103ef6dd1118334670ec00bb759825e777188fb2e7584ceab0754d978

SHA512
ab6700a01ce165c99a1f4254db672c2c423be07ee4cddaf818c0c28c8ba3833552dca530d13415542a318ac58e2a9fba225faab3924f03b4a0dbeae703ad662a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads