Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2022 01:02
Static task
static1
Behavioral task
behavioral1
Sample
8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe
-
Size
116KB
-
MD5
1e53a4a0891621320d8f53c698676281
-
SHA1
b64dfb8f637f2a7e0b807d48a66f11f44e1c6331
-
SHA256
8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7
-
SHA512
e708aff577195658708c7d1043c4fa8cf9901c5794d3ee9533566dec4501591b76ff8f8de199a0ebe1d72d80b898381ec4b1b81d365fef38b2b716d65146b220
-
SSDEEP
3072:s0T94Xnr99Rx7D/ONLd01eWkVkMfwYHX0WRSO:dZ477D2NLd01eWkVkMfwYHEWRn
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vfzuur.exe -
Executes dropped EXE 1 IoCs
pid Process 4860 vfzuur.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /r" vfzuur.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /h" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /v" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /a" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /u" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /i" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /d" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /w" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /j" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /y" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /n" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /f" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /t" vfzuur.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /v" 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /p" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /k" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /b" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /m" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /q" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /o" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /c" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /l" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /e" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /z" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /s" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /g" vfzuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfzuur = "C:\\Users\\Admin\\vfzuur.exe /x" vfzuur.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4084 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe 4084 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe 4860 vfzuur.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4084 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe 4860 vfzuur.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4084 wrote to memory of 4860 4084 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe 80 PID 4084 wrote to memory of 4860 4084 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe 80 PID 4084 wrote to memory of 4860 4084 8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe"C:\Users\Admin\AppData\Local\Temp\8df451e874f4246e877ed9bbb07b53039764fe74a0c5077c02f05e25264596b7.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\vfzuur.exe"C:\Users\Admin\vfzuur.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4860
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5174113356a85299ea0312104f6cfb0b4
SHA186a5a8270dc189cc7d2e08d5ac11bf9abfac36db
SHA256d5b5e8a34d6ceb3f67a0949d223cb3e53031ac5c571efbf7dba9290052b49dad
SHA512a8785a14d00f051403409731bfc2aced22d1d5586f45e1046fcd94b221923f790294e3a0f4ff33a73d2b2343aa2873ef9e48407682e693865867b997a4d5d6e2
-
Filesize
116KB
MD5174113356a85299ea0312104f6cfb0b4
SHA186a5a8270dc189cc7d2e08d5ac11bf9abfac36db
SHA256d5b5e8a34d6ceb3f67a0949d223cb3e53031ac5c571efbf7dba9290052b49dad
SHA512a8785a14d00f051403409731bfc2aced22d1d5586f45e1046fcd94b221923f790294e3a0f4ff33a73d2b2343aa2873ef9e48407682e693865867b997a4d5d6e2