Overview
overview
10Static
static
10001.exe
windows7_x64
10001.exe
windows10-2004_x64
101488.exe
windows7_x64
101488.exe
windows10-2004_x64
11_cr.exe
windows7_x64
51_cr.exe
windows10-2004_x64
41cr.exe
windows7_x64
101cr.exe
windows10-2004_x64
41fc2d.exe
windows7_x64
101fc2d.exe
windows10-2004_x64
106e7_2021-0...04.exe
windows7_x64
106e7_2021-0...04.exe
windows10-2004_x64
10Abjects.exe
windows7_x64
1Abjects.exe
windows10-2004_x64
4BattleText.exe
windows7_x64
10BattleText.exe
windows10-2004_x64
1HANS.exe
windows7_x64
3HANS.exe
windows10-2004_x64
1Hulu.exe
windows7_x64
8Hulu.exe
windows10-2004_x64
8IntelFIVE.exe
windows7_x64
3IntelFIVE.exe
windows10-2004_x64
7IntelFOUR.exe
windows7_x64
3IntelFOUR.exe
windows10-2004_x64
7IntelONE.exe
windows7_x64
3IntelONE.exe
windows10-2004_x64
7IntelTHREE.exe
windows7_x64
3IntelTHREE.exe
windows10-2004_x64
7IntelTWO.exe
windows7_x64
3IntelTWO.exe
windows10-2004_x64
7Lucky_Fixed.exe
windows7_x64
3Lucky_Fixed.exe
windows10-2004_x64
10Resubmissions
07-02-2022 00:34
220207-aw81qsdce2 10Analysis
-
max time kernel
154s -
max time network
243s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
07-02-2022 00:34
Behavioral task
behavioral1
Sample
001.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral2
Sample
001.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral3
Sample
1488.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral4
Sample
1488.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral5
Sample
1_cr.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral6
Sample
1_cr.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral7
Sample
1cr.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral8
Sample
1cr.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral9
Sample
1fc2d.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral10
Sample
1fc2d.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral11
Sample
6e7_2021-01-19_18-04.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral12
Sample
6e7_2021-01-19_18-04.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral13
Sample
Abjects.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral14
Sample
Abjects.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral15
Sample
BattleText.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral16
Sample
BattleText.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral17
Sample
HANS.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral18
Sample
HANS.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral19
Sample
Hulu.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral20
Sample
Hulu.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral21
Sample
IntelFIVE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral22
Sample
IntelFIVE.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral23
Sample
IntelFOUR.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral24
Sample
IntelFOUR.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral25
Sample
IntelONE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral26
Sample
IntelONE.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral27
Sample
IntelTHREE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral28
Sample
IntelTHREE.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral29
Sample
IntelTWO.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral30
Sample
IntelTWO.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral31
Sample
Lucky_Fixed.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral32
Sample
Lucky_Fixed.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
General
-
Target
Hulu.exe
-
Size
1.4MB
-
MD5
64be5264f3a58325446865be38c05b34
-
SHA1
fdbad9468075747a4999b7b30fa7cb7b60fdcb4e
-
SHA256
561a8b830e902a0ba18457a0aa8db8a8c663de8ee33e6009f236cedff00f8cbb
-
SHA512
d48fac03082d1f12cf1d175978f64e9d2df467828601b34474c77bf139c6c0dae5002ad2f1e106c46e6fb6c4ef8083e011931a74dd0adcbb0a43cdeae16cd0d0
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 464 Custodiva.exe.com 1020 Custodiva.exe.com 3588 RegAsm.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation Hulu.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GRyYpiVyQV.url Custodiva.exe.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1020 set thread context of 3588 1020 Custodiva.exe.com 80 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe -
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.660182" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132888443599895457" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4092" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3756 PING.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3688 2212 Hulu.exe 59 PID 2212 wrote to memory of 3688 2212 Hulu.exe 59 PID 2212 wrote to memory of 3688 2212 Hulu.exe 59 PID 2212 wrote to memory of 3160 2212 Hulu.exe 61 PID 2212 wrote to memory of 3160 2212 Hulu.exe 61 PID 2212 wrote to memory of 3160 2212 Hulu.exe 61 PID 3160 wrote to memory of 2100 3160 cmd.exe 63 PID 3160 wrote to memory of 2100 3160 cmd.exe 63 PID 3160 wrote to memory of 2100 3160 cmd.exe 63 PID 2100 wrote to memory of 2700 2100 cmd.exe 65 PID 2100 wrote to memory of 2700 2100 cmd.exe 65 PID 2100 wrote to memory of 2700 2100 cmd.exe 65 PID 2100 wrote to memory of 464 2100 cmd.exe 66 PID 2100 wrote to memory of 464 2100 cmd.exe 66 PID 2100 wrote to memory of 464 2100 cmd.exe 66 PID 2100 wrote to memory of 3756 2100 cmd.exe 67 PID 2100 wrote to memory of 3756 2100 cmd.exe 67 PID 2100 wrote to memory of 3756 2100 cmd.exe 67 PID 464 wrote to memory of 1020 464 Custodiva.exe.com 68 PID 464 wrote to memory of 1020 464 Custodiva.exe.com 68 PID 464 wrote to memory of 1020 464 Custodiva.exe.com 68 PID 1020 wrote to memory of 3588 1020 Custodiva.exe.com 80 PID 1020 wrote to memory of 3588 1020 Custodiva.exe.com 80 PID 1020 wrote to memory of 3588 1020 Custodiva.exe.com 80 PID 1020 wrote to memory of 3588 1020 Custodiva.exe.com 80 PID 1020 wrote to memory of 3588 1020 Custodiva.exe.com 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hulu.exe"C:\Users\Admin\AppData\Local\Temp\Hulu.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo xlEPMOAZC2⤵PID:3688
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe < Strazii.xlsm2⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^unowfSGqElRNjSdIsHGXTopdtGkBtbAqMZrTUgLOVVaETGrALikdphrYfSXIHyWiJRqhPbOeWSeXPEbbDKPWjlRmWyDwsruPYkUwFPLgzoxdlypLcmyWfqVmqBsKTMLSLjYEJcRNZBDrPAgQW$" Nel.xlm4⤵PID:2700
-
-
C:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\Custodiva.exe.comCustodiva.exe.com x4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\Custodiva.exe.comC:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\Custodiva.exe.com x5⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\RegAsm.exeC:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\RegAsm.exe6⤵
- Executes dropped EXE
PID:3588
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
PID:3756
-
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2512
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3832
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1820