Analysis
-
max time kernel
151s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 00:28
Static task
static1
Behavioral task
behavioral1
Sample
30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe
-
Size
196KB
-
MD5
6e5d028b07b57057aa2a659a7d4d72f0
-
SHA1
3e9ecad33ca5414f3517ba1e44eb68d08b7a36b6
-
SHA256
30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba
-
SHA512
a59dda40451bf16162a0e87e52a5b5840af6f19d034f62423363f64d44c412703fab8aafa7dc73f28fb9006d3c0e0cb9809a291bcc1be08e1dfc0917feb2f08b
-
SSDEEP
6144:Er4K16oTJWvfU4+bOl8femcK/fObT/bGimszUg7WqaJ:CAoTMvs4+bOlNK/fObT/bGip77gJ
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ruaob.exe -
Executes dropped EXE 1 IoCs
pid Process 1948 ruaob.exe -
Loads dropped DLL 2 IoCs
pid Process 1612 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe 1612 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /H" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /z" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /r" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /O" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /F" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /c" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /A" ruaob.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /Y" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /V" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /K" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /j" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /R" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /v" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /b" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /d" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /a" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /t" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /k" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /L" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /y" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /h" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /u" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /x" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /s" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /W" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /S" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /l" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /D" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /q" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /E" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /Z" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /i" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /N" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /p" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /T" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /U" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /m" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /g" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /P" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /f" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /Q" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /G" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /o" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /w" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /X" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /y" 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /J" ruaob.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /C" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /n" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /e" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /B" ruaob.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1612 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe 1948 ruaob.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1612 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe 1948 ruaob.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1948 1612 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe 26 PID 1612 wrote to memory of 1948 1612 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe 26 PID 1612 wrote to memory of 1948 1612 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe 26 PID 1612 wrote to memory of 1948 1612 30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe"C:\Users\Admin\AppData\Local\Temp\30f9ec52bb77f32611618ddd02af5f28d03aa2714f0adc8f90595c7bfe1adaba.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\ruaob.exe"C:\Users\Admin\ruaob.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5c717fa4bd4923f2bf5bbcafd3247cbfc
SHA165952f5934fe80f4d12c1e7d57c4731375e2be3a
SHA256ece086cb405ac5293092e18508e8bd38b7bead130d29db63195019c49410368d
SHA512c79dddbb28744b85e97258befc5d85ec2c4a876b74096af33db222f562483094a9f649f30670e107a3f8f3ba11ef9d02c960b6ff54c8f4312fc3360ab6c05c91
-
Filesize
196KB
MD5c717fa4bd4923f2bf5bbcafd3247cbfc
SHA165952f5934fe80f4d12c1e7d57c4731375e2be3a
SHA256ece086cb405ac5293092e18508e8bd38b7bead130d29db63195019c49410368d
SHA512c79dddbb28744b85e97258befc5d85ec2c4a876b74096af33db222f562483094a9f649f30670e107a3f8f3ba11ef9d02c960b6ff54c8f4312fc3360ab6c05c91
-
Filesize
196KB
MD5c717fa4bd4923f2bf5bbcafd3247cbfc
SHA165952f5934fe80f4d12c1e7d57c4731375e2be3a
SHA256ece086cb405ac5293092e18508e8bd38b7bead130d29db63195019c49410368d
SHA512c79dddbb28744b85e97258befc5d85ec2c4a876b74096af33db222f562483094a9f649f30670e107a3f8f3ba11ef9d02c960b6ff54c8f4312fc3360ab6c05c91
-
Filesize
196KB
MD5c717fa4bd4923f2bf5bbcafd3247cbfc
SHA165952f5934fe80f4d12c1e7d57c4731375e2be3a
SHA256ece086cb405ac5293092e18508e8bd38b7bead130d29db63195019c49410368d
SHA512c79dddbb28744b85e97258befc5d85ec2c4a876b74096af33db222f562483094a9f649f30670e107a3f8f3ba11ef9d02c960b6ff54c8f4312fc3360ab6c05c91