Analysis
- max time kernel
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 22:31
Behavioral task
behavioral1
Sample
25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe
- Size 206KB
- Sample260916-2fdy7sfa87
- SHA256 25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6
- MD5 a767229910d61289e9c70e9062e33226
- SHA1 3de137ce249ae428e1365672fba83b90ad699ba1
- SHA512 9d5de453650a98741d14c08654f4fe55da1a25113f388cd138cc203c17e3a8c410c210a50abc8745ffc7ecf8cd94a282c51d970caede1e58f23085bf2f86e2b3
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un+:5vEN2U+T6i5LirrllHy4HUcMQY6/
- TLSH T19F240A2BEE40705AE8E385F16866A2EABB212D661BC16C0F23D1AF4534B1513F5F531F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Mofksys worm 11 IoCs
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/files/0x0009000000024595-7.dat family_mofksys behavioral1/files/0x000800000002459a-13.dat family_mofksys behavioral1/memory/896-17-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/files/0x000800000002459c-24.dat family_mofksys behavioral1/memory/4496-33-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/memory/896-36-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/files/0x000800000002459f-37.dat family_mofksys behavioral1/memory/2888-38-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/memory/5128-39-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/memory/2968-40-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys - Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 5128 explorer.exe 896 spoolsv.exe 2968 svchost.exe 4496 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe 2888 25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe 5128 explorer.exe 5128 explorer.exe 5128 explorer.exe 5128 explorer.exe 5128 explorer.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 2968 svchost.exe 5128 explorer.exe 5128 explorer.exe 5128 explorer.exe 2968 svchost.exe 5128 explorer.exe 2968 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 5128 explorer.exe 2968 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2888 25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe 2888 25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe 5128 explorer.exe 5128 explorer.exe 896 spoolsv.exe 896 spoolsv.exe 2968 svchost.exe 2968 svchost.exe 4496 spoolsv.exe 4496 spoolsv.exe 5128 explorer.exe 5128 explorer.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2888 wrote to memory of 5128 2888 25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe 84 PID 5128 wrote to memory of 896 5128 explorer.exe 85 PID 896 wrote to memory of 2968 896 spoolsv.exe 86 PID 2968 wrote to memory of 4496 2968 svchost.exe 87 PID 2968 wrote to memory of 5952 2968 svchost.exe 88 PID 2968 wrote to memory of 1836 2968 svchost.exe 97 PID 2968 wrote to memory of 2084 2968 svchost.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe"C:\Users\Admin\AppData\Local\Temp\25bccbc27a3948a0e96640cfc833a62dce8b3465ddbe454abf0cfb9a715422c6.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visibility of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4496
-
-
C:\Windows\SysWOW64\at.exeat 23:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:5952
-
-
C:\Windows\SysWOW64\at.exeat 23:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:1836
-
-
C:\Windows\SysWOW64\at.exeat 23:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:2084
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 ac71642e0fd6b15422c0ff3eb296cf0f1ace2935cf505904f01b138415e6b143
- MD5 6d07e9abd5bf48c11ce823244d02da68
- SHA1 7eb69d08ab995c45e3c9f40c250a71a007acfb2f
- SHA512 e96b2a0448a3b57eff86c7e7df1ee5cec2e3db923beeadf18c4c0ca7f9ec88b0b670e1ead207f39ee6bb9a2afc140da5e4bad6544f18ac1ed9562cee419228e9
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un3:5vEN2U+T6i5LirrllHy4HUcMQY6c
- TLSH T16E24082BBA44B02FD56785F2142266AABA212E361FD25C5F27C0AF5635B1513F1F230F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 90bac11778e2fb24aef6a7ba4a1132afb28391b9e7eae90e288131ba2f869769
- MD5 cb13ebb3afe5c3fba3cb755b30d3fdca
- SHA1 fb2d407e82e2dcab137a8b2caf2f2e542b4b5b56
- SHA512 9eeafbc73eb8828d3b8f5bc2192692f070083d2ae30351bb93664f779fadbe7cd25ecbaa2199f4a9d06529bbf1549b66477e9f2e37b24a5157c6fc9343b8d68e
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unf:5vEN2U+T6i5LirrllHy4HUcMQY68
- TLSH T1E624FB1BBE45701FD4638AF15517B6A6BA313E261BD0AC0B6780AF8A7471903B2F531F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 d70804bbc535438583fbb564c061cdab3ab0ce267e40a0d710d803ebde899b19
- MD5 34b11e1ccaa6ca0db3f819f2ebec703f
- SHA1 659e2896a03cd6ad8e4070d9eaec30b610bbbd46
- SHA512 ee6e372eb4b927ae08686c3b61439ee4b9a5ca7cb408f2437ad89c093cb7e6ef36e1b6d0dc5915ac0556c7fe47fd4d13d81c7cf278571779e1a311218334e135
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unz:5vEN2U+T6i5LirrllHy4HUcMQY6W
- TLSH T14624D92FEE44702DE5A299F1582776A6FE211E362B80AC0F23D16F5535B2903B1B531F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 99e2f98413fd1b5c585c9898f210e2fca8724d47f2f42322f59cf48dbbcbf6c9
- MD5 d17e38e39e0874eaa91b33060c4ce6ca
- SHA1 5c8a6983c3d1e6fdaf1c97f6220c60b34d4e08b2
- SHA512 dbe48574762181a4c229c7dca99b4a636f5cef43c3f1474d6de5ab1861a4dfcde72be5ea990fda095801368389c043b7fdb9bc0f085fc4394611afdbb33ac709
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un2nnnnnnnnnnnnnnnnnnnnnI:5vEN2U+T6i5LirrllHy4HUcMQY6a
- TLSH T19124DA2BFA04602FF99286F0146675A6BA313E311BD1AC4B63E19F463871553B9F231F
- MD5 SHA1 SHA512 SSDEEP TLSH