944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c

General

Target

944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe
Size

67KB
MD5

f23b574fad39f213858dc68196f18cf4
SHA1

fc90f13de3f4219d2ba60c06f1accb67cac646af
SHA256

944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c
SHA512

0b0c84cd04cc65d34a4f0a6b713ba93bff86e14384e53fd4618484f273f1d8374953b03025f36d3da801d7bb3953f4ae75f61267833c0bdd1acbeb492cd871de
SSDEEP

1536:EgXsfgWQN1kYsRxWTg3PwSWe991Rdolpdz6JAkAG:1tWYfGATvPe9slp+ApG

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2940 explorer.exe
2932 spoolsv.exe
2904 svchost.exe
1488 spoolsv.exe

pid	process
2940	explorer.exe
2932	spoolsv.exe
2904	svchost.exe
1488	spoolsv.exe

Loads dropped DLL 8 IoCs

Processes:

944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exeexplorer.exespoolsv.exesvchost.exe

pid	process
2164	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe
2164	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe
2940	explorer.exe
2940	explorer.exe
2932	spoolsv.exe
2932	spoolsv.exe
2904	svchost.exe
2904	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

Processes:

944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exeexplorer.exespoolsv.exesvchost.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exeexplorer.exespoolsv.exesvchost.exespoolsv.exeat.exeat.exeat.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exeexplorer.exesvchost.exe

pid	process
2164	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2904	svchost.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2904	svchost.exe
2940	explorer.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2904	svchost.exe
2940	explorer.exe
2940	explorer.exe
2904	svchost.exe
2904	svchost.exe
2940	explorer.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2904	svchost.exe
2940	explorer.exe
2940	explorer.exe
2904	svchost.exe
2940	explorer.exe
2904	svchost.exe
2904	svchost.exe
2940	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2940 explorer.exe
2904 svchost.exe

pid	process
2940	explorer.exe
2904	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2164	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe
2164	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe
2940	explorer.exe
2940	explorer.exe
2932	spoolsv.exe
2932	spoolsv.exe
2904	svchost.exe
2904	svchost.exe
1488	spoolsv.exe
1488	spoolsv.exe
2940	explorer.exe
2940	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2164 wrote to memory of 2940	2164	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe	explorer.exe
PID 2164 wrote to memory of 2940	2164	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe	explorer.exe
PID 2164 wrote to memory of 2940	2164	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe	explorer.exe
PID 2164 wrote to memory of 2940	2164	944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe	explorer.exe
PID 2940 wrote to memory of 2932	2940	explorer.exe	spoolsv.exe
PID 2940 wrote to memory of 2932	2940	explorer.exe	spoolsv.exe
PID 2940 wrote to memory of 2932	2940	explorer.exe	spoolsv.exe
PID 2940 wrote to memory of 2932	2940	explorer.exe	spoolsv.exe
PID 2932 wrote to memory of 2904	2932	spoolsv.exe	svchost.exe
PID 2932 wrote to memory of 2904	2932	spoolsv.exe	svchost.exe
PID 2932 wrote to memory of 2904	2932	spoolsv.exe	svchost.exe
PID 2932 wrote to memory of 2904	2932	spoolsv.exe	svchost.exe
PID 2904 wrote to memory of 1488	2904	svchost.exe	spoolsv.exe
PID 2904 wrote to memory of 1488	2904	svchost.exe	spoolsv.exe
PID 2904 wrote to memory of 1488	2904	svchost.exe	spoolsv.exe
PID 2904 wrote to memory of 1488	2904	svchost.exe	spoolsv.exe
PID 2904 wrote to memory of 2452	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 2452	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 2452	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 2452	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 1528	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 1528	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 1528	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 1528	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 2272	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 2272	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 2272	2904	svchost.exe	at.exe
PID 2904 wrote to memory of 2272	2904	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe
"C:\Users\Admin\AppData\Local\Temp\944ce2e2bcee30b2efce0b366bf39e18cc1855bd824e7976db65b1a7779cb54c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2940
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1488
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:43 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:44 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
67KB

MD5
0970a6937a79e5ce27a365ea75ef6c93

SHA1
27d69a6c718d39bc8d305ba14dc27bf765b0dc4e

SHA256
72c722a4fe80b39f912ae226b7e9d21661f12cb43ef8d3587c14c9de6599118e

SHA512
f639f4898827a83af8f7634b82829abd357f6c2618e9e813fd319f8d2e586e41e046d0d969722d04c12142b9081175592c31cc4a5d7d7f844bc2e51585d228d3

Download Submit
C:\Windows\system\explorer.exe

Filesize
67KB

MD5
cb3b5ef1d36e34f88e80aa2fb855b7a9

SHA1
07451104db1e6e2bf7b3837b1dd5c641c4c68044

SHA256
4897b10b84b0e3cc15deb5b951ad3bd38a3e8f724b98beab7e626267f8ad8486

SHA512
ea714661a8204ba4b371e2799900dff87c904cebee89895c186883f7d8987da9ef43178de72d53d70e8204fce2f42218585042de79fa1732e4b150ab78b72f37

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
67KB

MD5
62174e79b205cc217018cc6a04eab524

SHA1
10d74acefbdb603de6ac59349927e18e60730d63

SHA256
4e53cb2d78c956d0b7a41364597456334ce53eee5544fb9e7f61694bf286b8c1

SHA512
ce54f588a8ba838241e7c1a700d22b9a581520b340bad0b0e8eb009025c2c65f21aff83894640ea492e7c380aa730ade90dacf148ebea3f5d4787263a6d9667d

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
67KB

MD5
350299719aa5bda901532e1065564bde

SHA1
0312bf0d29ddb05e7efebf410381261e50e74fd8

SHA256
7c7b652216ec7e30ed807a67038d4e568fc1f5703a033bc572ea426176d979c8

SHA512
72d17865e68146cbdbcd7b206dc02a270884f87de7a460bab884c473cd7d46a2280b95d0daa6b6078c0f513aae48eb5c247fd040f0d265bdce40539716f2e73e

Download Submit
memory/1488-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1488-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1488-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2164-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2164-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2164-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2164-16-0x0000000002B20000-0x0000000002B51000-memory.dmp

Filesize
196KB

Download
memory/2164-77-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2164-47-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2164-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2164-40-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2164-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2164-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2904-53-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2932-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2932-44-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2932-35-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2940-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2940-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2940-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2940-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2940-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2940-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads