Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe
-
Size
156KB
-
MD5
71890806fa56cc91f6a16df7765d7d4e
-
SHA1
585defa047a5a88390d59f61da864518c23a4747
-
SHA256
3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9
-
SHA512
bd2475ba980a7c2d8b7e7a1df80b0d9f59ffb54596d9c040a83199fc9ef260114681ec470fa875a242a890a339369347f9831f702bda4005c7ddbaa3abd0fe7b
-
SSDEEP
3072:IPmKPyD1gYTAohCjG8G3GbGVGBGfGuGxGWYcrf6KadE:IPnPygoAYcD6Kad
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" peamik.exe -
Executes dropped EXE 1 IoCs
pid Process 936 peamik.exe -
Loads dropped DLL 2 IoCs
pid Process 668 3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe 668 3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ peamik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\peamik = "C:\\Users\\Admin\\peamik.exe" peamik.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe 936 peamik.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 668 3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe 936 peamik.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 668 wrote to memory of 936 668 3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe 28 PID 668 wrote to memory of 936 668 3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe 28 PID 668 wrote to memory of 936 668 3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe 28 PID 668 wrote to memory of 936 668 3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe 28 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17 PID 936 wrote to memory of 668 936 peamik.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe"C:\Users\Admin\AppData\Local\Temp\3ee534e164f6dd94ed486fb4910e167ae184b7babb1cad070ed82b709e676ed9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\peamik.exe"C:\Users\Admin\peamik.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5b5d2ed1f2308db78b46b5040ed2430f8
SHA15aa70889dc2198c8fcb3accd7b15e4a79e6d456b
SHA2562d9629ff270ae6e2c2035540636785bebf4a71d7416e6efdca1e9b8b10f893a9
SHA512c4546f659e191d6624038d0bafb822e3bc8491f625473ed0343cf7f70caa57995cb46dbfdcdcc0af96a44a5975383eae9c35701a3402fae4363b15c86139f54c
-
Filesize
156KB
MD5b5d2ed1f2308db78b46b5040ed2430f8
SHA15aa70889dc2198c8fcb3accd7b15e4a79e6d456b
SHA2562d9629ff270ae6e2c2035540636785bebf4a71d7416e6efdca1e9b8b10f893a9
SHA512c4546f659e191d6624038d0bafb822e3bc8491f625473ed0343cf7f70caa57995cb46dbfdcdcc0af96a44a5975383eae9c35701a3402fae4363b15c86139f54c
-
Filesize
156KB
MD5b5d2ed1f2308db78b46b5040ed2430f8
SHA15aa70889dc2198c8fcb3accd7b15e4a79e6d456b
SHA2562d9629ff270ae6e2c2035540636785bebf4a71d7416e6efdca1e9b8b10f893a9
SHA512c4546f659e191d6624038d0bafb822e3bc8491f625473ed0343cf7f70caa57995cb46dbfdcdcc0af96a44a5975383eae9c35701a3402fae4363b15c86139f54c
-
Filesize
156KB
MD5b5d2ed1f2308db78b46b5040ed2430f8
SHA15aa70889dc2198c8fcb3accd7b15e4a79e6d456b
SHA2562d9629ff270ae6e2c2035540636785bebf4a71d7416e6efdca1e9b8b10f893a9
SHA512c4546f659e191d6624038d0bafb822e3bc8491f625473ed0343cf7f70caa57995cb46dbfdcdcc0af96a44a5975383eae9c35701a3402fae4363b15c86139f54c