Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 13:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
120 seconds
General
-
Target
95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe
-
Size
206KB
-
MD5
2728f8cbda969fc55ac899fc4d030300
-
SHA1
9faf3be0dd7dd6b387862606af3022ae9efee8f9
-
SHA256
95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29
-
SHA512
54a0293933efeee2651a3f3b0395b9e3eea25870b6cd43be9655d1d3f496a91e6a2803b29326cb7ab22653b92c85fab2fbc9250790181e0544aec6164e25fc0a
-
SSDEEP
3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unJ:zvEN2U+T6i5LirrllHy4HUcMQY6i
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
svchost.exeexplorer.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid Process 2124 explorer.exe 1424 spoolsv.exe 2800 svchost.exe 2704 spoolsv.exe -
Loads dropped DLL 8 IoCs
Processes:
95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exeexplorer.exespoolsv.exesvchost.exepid Process 1916 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe 1916 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe 2124 explorer.exe 2124 explorer.exe 1424 spoolsv.exe 1424 spoolsv.exe 2800 svchost.exe 2800 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
Processes:
explorer.exespoolsv.exesvchost.exe95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exedescription ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
at.exeat.exe95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exeexplorer.exesvchost.exepid Process 1916 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe 2124 explorer.exe 2124 explorer.exe 2124 explorer.exe 2800 svchost.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe 2124 explorer.exe 2800 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid Process 2124 explorer.exe 2800 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid Process 1916 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe 1916 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe 2124 explorer.exe 2124 explorer.exe 1424 spoolsv.exe 1424 spoolsv.exe 2800 svchost.exe 2800 svchost.exe 2704 spoolsv.exe 2704 spoolsv.exe 2124 explorer.exe 2124 explorer.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exeexplorer.exespoolsv.exesvchost.exedescription pid Process procid_target PID 1916 wrote to memory of 2124 1916 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe 31 PID 1916 wrote to memory of 2124 1916 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe 31 PID 1916 wrote to memory of 2124 1916 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe 31 PID 1916 wrote to memory of 2124 1916 95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe 31 PID 2124 wrote to memory of 1424 2124 explorer.exe 32 PID 2124 wrote to memory of 1424 2124 explorer.exe 32 PID 2124 wrote to memory of 1424 2124 explorer.exe 32 PID 2124 wrote to memory of 1424 2124 explorer.exe 32 PID 1424 wrote to memory of 2800 1424 spoolsv.exe 33 PID 1424 wrote to memory of 2800 1424 spoolsv.exe 33 PID 1424 wrote to memory of 2800 1424 spoolsv.exe 33 PID 1424 wrote to memory of 2800 1424 spoolsv.exe 33 PID 2800 wrote to memory of 2704 2800 svchost.exe 34 PID 2800 wrote to memory of 2704 2800 svchost.exe 34 PID 2800 wrote to memory of 2704 2800 svchost.exe 34 PID 2800 wrote to memory of 2704 2800 svchost.exe 34 PID 2800 wrote to memory of 2740 2800 svchost.exe 35 PID 2800 wrote to memory of 2740 2800 svchost.exe 35 PID 2800 wrote to memory of 2740 2800 svchost.exe 35 PID 2800 wrote to memory of 2740 2800 svchost.exe 35 PID 2800 wrote to memory of 2060 2800 svchost.exe 37 PID 2800 wrote to memory of 2060 2800 svchost.exe 37 PID 2800 wrote to memory of 2060 2800 svchost.exe 37 PID 2800 wrote to memory of 2060 2800 svchost.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe"C:\Users\Admin\AppData\Local\Temp\95770f512f29e3f16c0bcd44cdddd7efe515c23bdbfb638d3c57ed5cb1ae3b29N.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2704
-
-
C:\Windows\SysWOW64\at.exeat 13:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
C:\Windows\SysWOW64\at.exeat 13:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2060
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5f8cb042646ade99430fcc377f69accd2
SHA135ce04ac090c0d458ec9323da1b550bbb5202a0b
SHA256d2617322e69dc224cf56586b98b4658ab9aa7af2ef6cb924bda29f95291266c5
SHA51230d903cb0ca071c8613a98b76445db4c5f801ecb0c146dc4bd3c8a72ba02657e2ad868958ccde463c370cc12b2deb968f6a799ddc6c95c2af9001a814f241043
-
Filesize
206KB
MD5bc9f59257b6f9b3cb7c2ef52ce56fbca
SHA179883d9feb7be7cca61c441c04b0d15818bbfef3
SHA2561e4fc564b8d0183db82385ce2eb3e2fcc9b40037409547e3110ab647369e88ee
SHA5128816a2fc049485b207e7e701ef8563c599a7689e2b898717ec8b657392bdced8e8eb53f1f70f0d30fca766173a2c161150973172d9ae3bf4622db4ab0c84c9ed
-
Filesize
206KB
MD5039754e48a6046085f545611cdeb5b39
SHA12bdacd8ff92f27fd4734771b085900b8909ae598
SHA2563dd4b7416e15421438ddd9fdf49cb35fff16cea402e78f61b504bc2131d9e9a1
SHA5127d7be17850cdaec545da656c38f0abd1a636d6f4633d9ac0babc9b13637b25feddb0c0efd6dcc195dbe24993beabd3eac0768508140b9762c89ce32849490c12
-
Filesize
206KB
MD54b7bf55e5a21da7b3105abbd2ad7be57
SHA137d2f3a385bca86769040fd40fcc1e94079f2897
SHA256c36caded5fc302089477b5afdc306b8aebff29fcd3d2faae18d3bc1eb72fcc31
SHA5120235c6255f5a83a1b43bd9d3399c395ceeca72d302fccdce0f850d87aa232734203c3867ed3dd68afbb5709550d91155be704cb54d0e35b76928900f7b2a05bf