Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 15:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
120 seconds
General
-
Target
bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe
-
Size
206KB
-
MD5
b64e67781bfecfbaa723385fd95fbae0
-
SHA1
961f3b693a11bf2df43da0998f9cdb06a712a11b
-
SHA256
bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3
-
SHA512
a8433780712e723c5486d5a9ee9f001998ac397ada0776f8d786f4a4ee0f3c77c2d4b3bb282a4ab19793dfb0ddb7b259a0d38d219dfff2fe1d98ea734fcbfb25
-
SSDEEP
3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unkw:zvEN2U+T6i5LirrllHy4HUcMQY6k
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 2904 explorer.exe 2828 spoolsv.exe 1492 svchost.exe 2676 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 2768 bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe 2768 bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe 2904 explorer.exe 2904 explorer.exe 2828 spoolsv.exe 2828 spoolsv.exe 1492 svchost.exe 1492 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2768 bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 1492 svchost.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe 1492 svchost.exe 2904 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2904 explorer.exe 1492 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2768 bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe 2768 bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe 2904 explorer.exe 2904 explorer.exe 2828 spoolsv.exe 2828 spoolsv.exe 1492 svchost.exe 1492 svchost.exe 2676 spoolsv.exe 2676 spoolsv.exe 2904 explorer.exe 2904 explorer.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2904 2768 bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe 30 PID 2768 wrote to memory of 2904 2768 bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe 30 PID 2768 wrote to memory of 2904 2768 bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe 30 PID 2768 wrote to memory of 2904 2768 bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe 30 PID 2904 wrote to memory of 2828 2904 explorer.exe 31 PID 2904 wrote to memory of 2828 2904 explorer.exe 31 PID 2904 wrote to memory of 2828 2904 explorer.exe 31 PID 2904 wrote to memory of 2828 2904 explorer.exe 31 PID 2828 wrote to memory of 1492 2828 spoolsv.exe 32 PID 2828 wrote to memory of 1492 2828 spoolsv.exe 32 PID 2828 wrote to memory of 1492 2828 spoolsv.exe 32 PID 2828 wrote to memory of 1492 2828 spoolsv.exe 32 PID 1492 wrote to memory of 2676 1492 svchost.exe 33 PID 1492 wrote to memory of 2676 1492 svchost.exe 33 PID 1492 wrote to memory of 2676 1492 svchost.exe 33 PID 1492 wrote to memory of 2676 1492 svchost.exe 33 PID 1492 wrote to memory of 1892 1492 svchost.exe 34 PID 1492 wrote to memory of 1892 1492 svchost.exe 34 PID 1492 wrote to memory of 1892 1492 svchost.exe 34 PID 1492 wrote to memory of 1892 1492 svchost.exe 34 PID 1492 wrote to memory of 2980 1492 svchost.exe 36 PID 1492 wrote to memory of 2980 1492 svchost.exe 36 PID 1492 wrote to memory of 2980 1492 svchost.exe 36 PID 1492 wrote to memory of 2980 1492 svchost.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe"C:\Users\Admin\AppData\Local\Temp\bd1a6b1ef69a1f618af1f4e06b28b218ad726ef400eca8d535040227a99d82f3N.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2676
-
-
C:\Windows\SysWOW64\at.exeat 15:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:1892
-
-
C:\Windows\SysWOW64\at.exeat 15:38 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2980
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD54c9755ff82d960f5fdc08b6f1d479e2c
SHA1cbe501953586df6cc8b42a44619ab47530e5aa4c
SHA256a653dd5ee4790d34693691aac4ce6efd98275f24265338da4deee811445a0b83
SHA5125821a60e1f656a5d35eb5eb0b1bd20f957badc409b7159c3ba613cdae3981ea107dd40950da1f036b8fd8c9da9bd2246984d1bac0686a2630404103615c4b435
-
Filesize
206KB
MD5fa95dfed37ef1b6bb33f66299097a406
SHA1b4fadaae89a67daa6cb85cc0e9acbe3456e22a44
SHA256cf5d34d1d5b7d3c7ba93465ba7b149677e35ff6b4fc1a74c9de318300aec9aad
SHA512f76664a07f684eaf58d924073fb53341cbbbbc52574ceb9f80dc11075b68b13401f746049fad753decdd4327256dff238871f2a227525b88685e46a1f2fa5b3d
-
Filesize
206KB
MD590b09f3d0fa546bcf7cd4e6e2674c399
SHA111327b39f845b6914ca4b9b96235c0229ad3704b
SHA2564a90c48b9080ab7aad1a2a746e967b8ea3b85e7586fcebd03aa33cc4ac27e206
SHA512c00c08b50f91c2607d6ae0f142e32d9be80da54758330ac4a1460e12803c6665cf1aef761ae9cf6634c12f1d057bded3b791ae94d51017128269bd0bd4c8f9cb
-
Filesize
206KB
MD521049da3dfe18b3f967e8af5e8e6407e
SHA1d1009c147427fd2464d547b7f539eaf61998d029
SHA2565263749cc89f8365dc33c41b201f8cd56c853985200517ea2f1a71bb9d2d6d03
SHA5123a73d60e4a1428a8c3fd157acb359c28f978bed88a7be5d33bfbeb2c924c45a161a15a9337223a6d5201a2128a3216164818ef04a945be2ac565191bb66a5ae7