Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 19:00
Behavioral task
behavioral1
Sample
0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe
- Size 206KB
- Sample260916-xnpy8acg86
- SHA256 0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850
- MD5 256313b1bfe5e8fd2a62c15a20a1da6b
- SHA1 643d4854057e033e5fb190c6af033773701ac54b
- SHA512 48fb9987e4c288dc14671719074d2638e828365bfd13c05e0bcfc217e09bd809b955714f007c23959e55093579dac0e8a223acd9e62b97453f5610d9e384509f
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unMq:zvEN2U+T6i5LirrllHy4HUcMQY6c
- TLSH T1C924192BBE00702ADC63C5F06926626A7A326E351BD19C0FA3D16F8534B4563B5F532F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Mofksys worm 4 IoCs
resource yara_rule behavioral1/files/0x00090000000243ab-6.dat family_mofksys behavioral1/files/0x00080000000243b0-12.dat family_mofksys behavioral1/files/0x00080000000243b2-22.dat family_mofksys behavioral1/files/0x00080000000243b5-33.dat family_mofksys - Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 1080 explorer.exe 2524 spoolsv.exe 1840 svchost.exe 688 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2160 0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe 2160 0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe 1840 svchost.exe 1840 svchost.exe 1080 explorer.exe 1080 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1080 explorer.exe 1840 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2160 0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe 2160 0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe 1080 explorer.exe 1080 explorer.exe 2524 spoolsv.exe 2524 spoolsv.exe 1840 svchost.exe 1840 svchost.exe 688 spoolsv.exe 688 spoolsv.exe 1080 explorer.exe 1080 explorer.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2160 wrote to memory of 1080 2160 0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe 87 PID 1080 wrote to memory of 2524 1080 explorer.exe 89 PID 2524 wrote to memory of 1840 2524 spoolsv.exe 90 PID 1840 wrote to memory of 688 1840 svchost.exe 91 PID 1840 wrote to memory of 4656 1840 svchost.exe 92 PID 1840 wrote to memory of 3968 1840 svchost.exe 99 PID 1840 wrote to memory of 3448 1840 svchost.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe"C:\Users\Admin\AppData\Local\Temp\0c93fc8ad8255bd79442a41f515b94902195d90323c5a93b21f3d419c0368850.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visibility of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:688
-
-
C:\Windows\SysWOW64\at.exeat 20:02 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:4656
-
-
C:\Windows\SysWOW64\at.exeat 20:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:3968
-
-
C:\Windows\SysWOW64\at.exeat 20:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:3448
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 cee3a713487297793ec46bea8ebaea885b29598e4492c25a53ee5f10e0aa37f0
- MD5 d1f9fecd6af4a56644d030862489658c
- SHA1 a4221853becbd1a41705e6867a73ae612ed1c675
- SHA512 3ecc88a10234be32781dccc4530dd6d3b76543365c6a5008224c054e952e62ed7bb7ebbb8c145af391bb0223f4f2a9ec633d2397dc1972abe8674bf1baae62e7
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unMP:zvEN2U+T6i5LirrllHy4HUcMQY6J
- TLSH T18624F62BFA04612EDD6386F02466A56ABA352D261FE09C0F63C0BF8535B5543B5F432F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\explorer.exe
- Size 207KB
- SHA256 81a59717e6db489ef681cdadeeaae6196af630ca1f955fbd1adf8db997f9c630
- MD5 498f91c296537a0aacd1720a42e8e12b
- SHA1 78ceeb0bfcee8b8ed92e25d6c421c9c9f62dab35
- SHA512 55afc0b1d206d63224d1f864108dbbdef99435bccf58dd7672a60ae269d4e00ec24e8af3caf52a218a203641b26595be2939d9d6ff53eecb95f43085c8b0040a
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unMbPPPPPPPPPPPPPPPPPPPPh:zvEN2U+T6i5LirrllHy4HUcMQY6/
- TLSH T1AC242B2BFE00712EDD6386F05426A1E6B5212E261BA2AC4B73D16F857074513F6F632F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 cfff97b3510ecad112aea4513ca3e3f527fc2c737160ce6b25c61a8eb26057ef
- MD5 516ee53dc454e076f0622dad9843ecff
- SHA1 c7643c2590276e7ec546e44bd713d489334c2b9f
- SHA512 345da96b915969fdc2c652ea5a58aa167fe0d9bc77efa885296395b9963e2466f5c336ccd5206df4a2a4e3349cc1d3be4d2df8858161c1a67cdf7bfc897b66f9
- SSDEEP 6144:zvEN2U+T6i5LirrllHy4HUcMQY6l22222222222222222222222222222222222F:zENN+T5xYrllrU7QY6l2222222222222
- TLSH T1C624082BBB00712ED893C5F11876B5A6BA362D361B90AC4F66D1BB4638B0513B1F531F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 ebd789823160ab850a4d6d6055d294211d7d96113d603d95cce9373e88a3983e
- MD5 09361551544523321542f997f50233c0
- SHA1 f03773df4e46dcf874d39dc00b4ca60e69fed4c1
- SHA512 79eb207cfc6a8676fa7ff56354e1dd9014323868a46a595c5553969222e7eb8e806df82a9a3479dcfc6eb4d3d93109fc264921713682276187849ff773692b5e
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unMp:zvEN2U+T6i5LirrllHy4HUcMQY6j
- TLSH T17F24F82BFA04612ED89386F09466A2A776316E221F91BC4F77C16F8938B5503B5F131F
- MD5 SHA1 SHA512 SSDEEP TLSH