Analysis
-
max time kernel
158s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-09-2022 14:55
Static task
static1
Behavioral task
behavioral1
Sample
73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe
-
Size
52KB
-
MD5
6473b074b73b9ca176311bf100e02d9a
-
SHA1
19c03060ab2bedf181df7f406a31e90db8e8ac1d
-
SHA256
73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18
-
SHA512
dcb5a7d278169292ba0291386b72e9bccc6064d9b12f99cbf90a9d3513f7036b7863cd0e3fae8c9195cbf29ae472d3b1d4bd53608268656d31ea7dc31ee12d7c
-
SSDEEP
768:OWEJbB6haGnJntgTVH7NHaurxmWXOQfwoObuPb77e5yC:OWE96Jnml5lXAoO+H7cyC
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xoausuf.exe -
Executes dropped EXE 1 IoCs
pid Process 520 xoausuf.exe -
Loads dropped DLL 2 IoCs
pid Process 864 73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe 864 73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xoausuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\xoausuf = "C:\\Users\\Admin\\xoausuf.exe" xoausuf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe 520 xoausuf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 864 73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe 520 xoausuf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 864 wrote to memory of 520 864 73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe 28 PID 864 wrote to memory of 520 864 73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe 28 PID 864 wrote to memory of 520 864 73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe 28 PID 864 wrote to memory of 520 864 73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe 28 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15 PID 520 wrote to memory of 864 520 xoausuf.exe 15
Processes
-
C:\Users\Admin\AppData\Local\Temp\73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe"C:\Users\Admin\AppData\Local\Temp\73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\xoausuf.exe"C:\Users\Admin\xoausuf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD53183807228637a57178460b6e30d2a54
SHA1bc5db49af1a524631cc62cc9730ba89fea3a7f1c
SHA256afa75fd30cc5f704c50c5b707d1436427ee6034b3f312129134f3de8e14d109f
SHA512824e7b5e33796b2880655e351d8e0cc98263d3e31d9d0d5cc4b164137487bb4840ac43ec2f60a6b3abda7f982f32ab278858bdda5189bab6f9732886fc72d585
-
Filesize
52KB
MD53183807228637a57178460b6e30d2a54
SHA1bc5db49af1a524631cc62cc9730ba89fea3a7f1c
SHA256afa75fd30cc5f704c50c5b707d1436427ee6034b3f312129134f3de8e14d109f
SHA512824e7b5e33796b2880655e351d8e0cc98263d3e31d9d0d5cc4b164137487bb4840ac43ec2f60a6b3abda7f982f32ab278858bdda5189bab6f9732886fc72d585
-
Filesize
52KB
MD53183807228637a57178460b6e30d2a54
SHA1bc5db49af1a524631cc62cc9730ba89fea3a7f1c
SHA256afa75fd30cc5f704c50c5b707d1436427ee6034b3f312129134f3de8e14d109f
SHA512824e7b5e33796b2880655e351d8e0cc98263d3e31d9d0d5cc4b164137487bb4840ac43ec2f60a6b3abda7f982f32ab278858bdda5189bab6f9732886fc72d585
-
Filesize
52KB
MD53183807228637a57178460b6e30d2a54
SHA1bc5db49af1a524631cc62cc9730ba89fea3a7f1c
SHA256afa75fd30cc5f704c50c5b707d1436427ee6034b3f312129134f3de8e14d109f
SHA512824e7b5e33796b2880655e351d8e0cc98263d3e31d9d0d5cc4b164137487bb4840ac43ec2f60a6b3abda7f982f32ab278858bdda5189bab6f9732886fc72d585