Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe
-
Size
80KB
-
MD5
9c598a3a2ae0bba7b89548671bacf031
-
SHA1
a18ed3ea0abf429c01dadfc75dddac5e435375aa
-
SHA256
7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f
-
SHA512
8d7d654345fc00d7d37845eb857cbdbdf0fa44d1d0b7d4152b73cfb97bd6c26bbecdb04f4a0fc62f9614025c7de498d8736f03a5eab28ff18c0bd10a476dd914
-
SSDEEP
768:ev6nMfq8W4g3YdoSvc8ebdtF5EmpW/p/hxRSH9NxIkL9v/Q6sWz:evHgiozZKmpSFhxRSHdL9bsC
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rioahim.exe -
Executes dropped EXE 1 IoCs
pid Process 888 rioahim.exe -
Loads dropped DLL 2 IoCs
pid Process 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ rioahim.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\rioahim = "C:\\Users\\Admin\\rioahim.exe" rioahim.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1488 1680 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe 888 rioahim.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 888 rioahim.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 888 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 28 PID 1680 wrote to memory of 888 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 28 PID 1680 wrote to memory of 888 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 28 PID 1680 wrote to memory of 888 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 28 PID 1680 wrote to memory of 1488 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 29 PID 1680 wrote to memory of 1488 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 29 PID 1680 wrote to memory of 1488 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 29 PID 1680 wrote to memory of 1488 1680 7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1680 888 rioahim.exe 27 PID 888 wrote to memory of 1488 888 rioahim.exe 29 PID 888 wrote to memory of 1488 888 rioahim.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe"C:\Users\Admin\AppData\Local\Temp\7f1a2328482e3c761f457cf818850d5c35493dfa3ab790fc01d3fc42a4fd6c7f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\rioahim.exe"C:\Users\Admin\rioahim.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 7962⤵
- Program crash
PID:1488
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5e5fefc8ac31c702e6f68cd0d295f9ec6
SHA11e6ecc69eb08cf4009ceba60661e94caa617691b
SHA256fa991547a76ea4f8fed1bcc31e6cc73f4d9ec71d6579cd75a5f1f0c242be4a97
SHA512169d6315e59283681173a701add3cbeff5c78acde58293ae7196e237d76bc7263b8e650b9949b48b2f9664e5f5347dabba7e62fa35bff08fc3d0d673f1838d26
-
Filesize
80KB
MD5e5fefc8ac31c702e6f68cd0d295f9ec6
SHA11e6ecc69eb08cf4009ceba60661e94caa617691b
SHA256fa991547a76ea4f8fed1bcc31e6cc73f4d9ec71d6579cd75a5f1f0c242be4a97
SHA512169d6315e59283681173a701add3cbeff5c78acde58293ae7196e237d76bc7263b8e650b9949b48b2f9664e5f5347dabba7e62fa35bff08fc3d0d673f1838d26
-
Filesize
80KB
MD5e5fefc8ac31c702e6f68cd0d295f9ec6
SHA11e6ecc69eb08cf4009ceba60661e94caa617691b
SHA256fa991547a76ea4f8fed1bcc31e6cc73f4d9ec71d6579cd75a5f1f0c242be4a97
SHA512169d6315e59283681173a701add3cbeff5c78acde58293ae7196e237d76bc7263b8e650b9949b48b2f9664e5f5347dabba7e62fa35bff08fc3d0d673f1838d26
-
Filesize
80KB
MD5e5fefc8ac31c702e6f68cd0d295f9ec6
SHA11e6ecc69eb08cf4009ceba60661e94caa617691b
SHA256fa991547a76ea4f8fed1bcc31e6cc73f4d9ec71d6579cd75a5f1f0c242be4a97
SHA512169d6315e59283681173a701add3cbeff5c78acde58293ae7196e237d76bc7263b8e650b9949b48b2f9664e5f5347dabba7e62fa35bff08fc3d0d673f1838d26