Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/11/2026, 22:44
Behavioral task
behavioral1
Sample
543f44441b581cd9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
543f44441b581cd9.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 543f44441b581cd9.exe
- Size 206KB
- Sample261111-2nr6sscd83
- SHA256 543f44441b581cd96a4d0d295b213be8429d98fb42afa187058e8dff428f7b6d
- MD5 19cb653f16093cfaa222b95cd655a177
- SHA1 f0d6cd2e6cb9581ef434ce30dedaebe6fed43ac1
- SHA512 319d79e36ff7d186c45681c33510a75c403c86cc603b9b2464b6000879f1512b10224eb9bf91104447af63e29fb096e66915fad7a9848ba5d5964129c88bdf59
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unGd:5vEN2U+T6i5LirrllHy4HUcMQY6Jd
- TLSH T17124E82BFA40B17FD4A7C6F0582572A6BA252D621B90DC4F22D26F463876543B6F130F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Mofksys worm 11 IoCs
resource yara_rule behavioral1/memory/1680-0-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/memory/2884-9-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/files/0x000500000001dbac-8.dat family_mofksys behavioral1/files/0x000d00000002444c-13.dat family_mofksys behavioral1/files/0x00080000000244a2-24.dat family_mofksys behavioral1/memory/4900-33-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/memory/4224-36-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/files/0x00080000000244a5-37.dat family_mofksys behavioral1/memory/1680-38-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/memory/2884-39-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys behavioral1/memory/1944-40-0x0000000000400000-0x0000000000440000-memory.dmp family_mofksys - Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 2884 explorer.exe 4224 spoolsv.exe 1944 svchost.exe 4900 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 543f44441b581cd9.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 543f44441b581cd9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1680 543f44441b581cd9.exe 1680 543f44441b581cd9.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe 1944 svchost.exe 1944 svchost.exe 2884 explorer.exe 2884 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2884 explorer.exe 1944 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1680 543f44441b581cd9.exe 1680 543f44441b581cd9.exe 2884 explorer.exe 2884 explorer.exe 4224 spoolsv.exe 4224 spoolsv.exe 1944 svchost.exe 1944 svchost.exe 4900 spoolsv.exe 4900 spoolsv.exe 2884 explorer.exe 2884 explorer.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2884 1680 543f44441b581cd9.exe 84 PID 2884 wrote to memory of 4224 2884 explorer.exe 85 PID 4224 wrote to memory of 1944 4224 spoolsv.exe 86 PID 1944 wrote to memory of 4900 1944 svchost.exe 87 PID 1944 wrote to memory of 452 1944 svchost.exe 88 PID 1944 wrote to memory of 3800 1944 svchost.exe 101 PID 1944 wrote to memory of 4716 1944 svchost.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\543f44441b581cd9.exe"C:\Users\Admin\AppData\Local\Temp\543f44441b581cd9.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visibility of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4900
-
-
C:\Windows\SysWOW64\at.exeat 22:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:452
-
-
C:\Windows\SysWOW64\at.exeat 22:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:3800
-
-
C:\Windows\SysWOW64\at.exeat 22:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
- System Location Discovery: System Language Discovery
PID:4716
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 bcfdca6cb402b6d25c944e774b4ffae088441076e62a35ef5145a040b320b961
- MD5 8f1e58037982b0882d7605e55b07364d
- SHA1 b057cd0a8f4539d78f6833506f49da2880f1073b
- SHA512 9b8a387660ae98e2f1a336bd9dd39ae27c6ea15050725c797891398d989b8dc54c40f515726e8c51619afe94928ea4c63704be5fb5cb6137cfd4bb948c1edd82
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unG2:5vEN2U+T6i5LirrllHy4HUcMQY6J2
- TLSH T1E024E92BFA00702ED8A3D5F06467A6AEF5216D721F91AC0B16806F853871A53F5F532F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 0fcebf7ee24a1d2f27c7ac66be6029714f3a3ed666a009c743b8bab9346ce6b2
- MD5 4ca20d91a6cc6e93b9c162a8b943c406
- SHA1 60b33eb37b0b336b82e4a17399e040ccd1886ff8
- SHA512 0595daad71f2681fc956189f35f1ee210f296d4714aec0f6b4a2974d03f92d03dac8b52f6219e9b3b4cfa647911482849190926affbb7e72e8f6ae9ab9a7fdec
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unGy:5vEN2U+T6i5LirrllHy4HUcMQY6Jy
- TLSH T13824082BFB41311DE4A7C5F0942669A6B6262D362B81AC0F23C15F5724B9243F5F932F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\svchost.exe
- Size 207KB
- SHA256 2032f41fbf111bbbfa6c1347d91af25c0c6bc9760331f200e466fcafe7eb2988
- MD5 d402ba4ffefeeedcc0dc4ec178f3ad0d
- SHA1 28e54f8b241a10e1cb7ed237c947518e9880a708
- SHA512 3643f5e6c006af5f9e1671ac585fb8be0b09f0528b8899608fa4508eaae8fe91ba24db4551910ef81828ce983f0a8906555db43b8fb6d7674c720965263b29e3
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unG5:5vEN2U+T6i5LirrllHy4HUcMQY6J5
- TLSH T161241C2BEA10701AD867D6F15C3762AAB7212E311BD1AC0B57D0AF9534B1603BAF531F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\system\explorer.exe
- Size 207KB
- SHA256 76c45312ebf930d33760e2bacaf2a45d94ae8e0740a31d355fd873fa1820422d
- MD5 cc73407b0cccb698dcfc738cc1008e37
- SHA1 8639d23e1fd83f7b18613a0a1836e3b61f440ae6
- SHA512 fb801c3caba353743c9a92595287c07c0e26ff90015aabb22142683f492e14b6832129083332c87de7ab81192f662af9d8bf00a0b5038189915351ee875d5f94
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unGj:5vEN2U+T6i5LirrllHy4HUcMQY6Jj
- TLSH T1FE24E92BFA40716ED4578AF054A761BBB6116E620BC1AC4F23D1AB4938B6613F1F431F
- MD5 SHA1 SHA512 SSDEEP TLSH