Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 15:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
120 seconds
General
-
Target
e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe
-
Size
206KB
-
MD5
baafedd50fa04d016a17d3d14338f280
-
SHA1
d18576d842b724b63ff53496b26163be1adbdbc0
-
SHA256
e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714
-
SHA512
c973108d639cf86839d13a9b36f916198f08abb45e6c68d614557ae9de57f88900f4a6e5a3a48365a34d2bbdce11cbc3f800978973ae29100c2514c2d29b67da
-
SSDEEP
3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unF:zvEN2U+T6i5LirrllHy4HUcMQY6a
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 2164 explorer.exe 2960 spoolsv.exe 2864 svchost.exe 2200 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 3052 e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe 3052 e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe 2164 explorer.exe 2164 explorer.exe 2960 spoolsv.exe 2960 spoolsv.exe 2864 svchost.exe 2864 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3052 e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe 2164 explorer.exe 2164 explorer.exe 2164 explorer.exe 2864 svchost.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe 2164 explorer.exe 2864 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2164 explorer.exe 2864 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3052 e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe 3052 e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe 2164 explorer.exe 2164 explorer.exe 2960 spoolsv.exe 2960 spoolsv.exe 2864 svchost.exe 2864 svchost.exe 2200 spoolsv.exe 2200 spoolsv.exe 2164 explorer.exe 2164 explorer.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2164 3052 e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe 31 PID 3052 wrote to memory of 2164 3052 e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe 31 PID 3052 wrote to memory of 2164 3052 e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe 31 PID 3052 wrote to memory of 2164 3052 e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe 31 PID 2164 wrote to memory of 2960 2164 explorer.exe 32 PID 2164 wrote to memory of 2960 2164 explorer.exe 32 PID 2164 wrote to memory of 2960 2164 explorer.exe 32 PID 2164 wrote to memory of 2960 2164 explorer.exe 32 PID 2960 wrote to memory of 2864 2960 spoolsv.exe 33 PID 2960 wrote to memory of 2864 2960 spoolsv.exe 33 PID 2960 wrote to memory of 2864 2960 spoolsv.exe 33 PID 2960 wrote to memory of 2864 2960 spoolsv.exe 33 PID 2864 wrote to memory of 2200 2864 svchost.exe 34 PID 2864 wrote to memory of 2200 2864 svchost.exe 34 PID 2864 wrote to memory of 2200 2864 svchost.exe 34 PID 2864 wrote to memory of 2200 2864 svchost.exe 34 PID 2864 wrote to memory of 2632 2864 svchost.exe 35 PID 2864 wrote to memory of 2632 2864 svchost.exe 35 PID 2864 wrote to memory of 2632 2864 svchost.exe 35 PID 2864 wrote to memory of 2632 2864 svchost.exe 35 PID 2864 wrote to memory of 2676 2864 svchost.exe 37 PID 2864 wrote to memory of 2676 2864 svchost.exe 37 PID 2864 wrote to memory of 2676 2864 svchost.exe 37 PID 2864 wrote to memory of 2676 2864 svchost.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe"C:\Users\Admin\AppData\Local\Temp\e42621e2a5208e82867501da32bd1530e4a8d30ff389247c1cdd80dfeac6b714N.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2200
-
-
C:\Windows\SysWOW64\at.exeat 15:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2632
-
-
C:\Windows\SysWOW64\at.exeat 15:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2676
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD549b6132b8d251281fd5acb9ad0d7d055
SHA181c708cc52842aaa2bb1fe6a1b8f6c96de57cc9d
SHA25612a666b791a04a5ff9d1309068715e150236b47acc716c39bf9df6387a78b4a0
SHA512d516ac67555623ac4dc435946a843738193be71b6dbf6f6af127b4ab4e94c3558abca41b9cfac2ecef9724d70995dcb2913bfecd3da8787647417c59345f25eb
-
Filesize
206KB
MD5cc2381c5605df9679d4ecfffff0c1202
SHA1e2b9c3bd4d5d1549eb846c4989c11df3c5f3449f
SHA2568d26c134c364fc3603a4c841da915583e001085da1dcc374c43c787264458de2
SHA512acf27afc4d2f4cb64fb8e676a9dde3df80c8715ad4f9e14cda538c2226a6c09f41f88103156cdb8434325f5ccd9c291ca62da90d8d18505164f9d67d59608059
-
Filesize
206KB
MD5c58395c5e8e974937f6d18b0cdbf1d4c
SHA15ee908ca2846ad3677b8728aa89981598ecd144f
SHA2561384d58bfe9c5c84ef6e96ac4694bbf2947e39875ded82826a36093a358b4c8e
SHA512282c87680b61c74f2ffca5cfd6ced23d44bd353e74806d9656986329c4af8405ed41fe48a9f557e82f59397efecd5fcbe80842316fe53c434895b529a4aef05f
-
Filesize
206KB
MD50c76538adc9c7cf542fa7270cf2bfc0a
SHA182baaaab56fac5264b8f0c16585aa85c07de24c3
SHA256053955711445235bd35eada2b7f01e845ee469aa8129f048073c796cebddd183
SHA5127090be066183ceab2b8b59faa479cbdf7f5ab554cd02d31378d5b0048641c649e3ae21ab795d3ece2e9d42c9d89fe4d44042958dbd60b66e73ae5cc3f5463d19