Analysis
-
max time kernel
152s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 07:39
Static task
static1
Behavioral task
behavioral1
Sample
3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe
-
Size
136KB
-
MD5
7267aa8bebba90166c08e7731d106d93
-
SHA1
9f32a59cd827a571ac72a7444ba62dc71e4665d1
-
SHA256
3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d
-
SHA512
5c5c4ba0ac57955291abd88acc04fc8186192ecce4d90b5740bcdfb377e2765511bea72ffe2b3497957b5fedccf67e5a9f679ea38adc38af9fb699a6ad0b4299
-
SSDEEP
3072:4vi0RG/J9Fc38E6tZqAwph5dKPbo3CfNynXp5ucK1FajaB0W+A:KirkAwBaSW+A
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" koaov.exe -
Executes dropped EXE 1 IoCs
pid Process 4064 koaov.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /m" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /r" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /o" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /k" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /p" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /q" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /y" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /c" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /u" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /x" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /f" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /x" 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /v" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /g" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /n" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /h" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /j" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /w" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /i" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /l" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /a" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /e" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /b" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /z" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /t" koaov.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /s" koaov.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koaov = "C:\\Users\\Admin\\koaov.exe /d" koaov.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2820 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe 2820 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe 4064 koaov.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2820 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe 4064 koaov.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2820 wrote to memory of 4064 2820 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe 88 PID 2820 wrote to memory of 4064 2820 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe 88 PID 2820 wrote to memory of 4064 2820 3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe"C:\Users\Admin\AppData\Local\Temp\3778565305a4a45bf9f9652268214fac294c0ee7f6c9b4162b28d5e3e3ac207d.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\koaov.exe"C:\Users\Admin\koaov.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4064
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5184417080dd514b85b6c00a214f26fc3
SHA184972b6e09da18ad8866540b1d5ed285bd8f75aa
SHA256f412fe9c0f1ec5ae39b6ac750a001d313bb3617e262bd4422041ec5e5592cf3b
SHA512524404564fba7cbb777bcd28d3688a161ffc033d18d2f9de7d910e6c28435bf3f8019312357952991e3d93040c16cbea6c244ac0959d0d5e35d38122cb9a1838
-
Filesize
136KB
MD5184417080dd514b85b6c00a214f26fc3
SHA184972b6e09da18ad8866540b1d5ed285bd8f75aa
SHA256f412fe9c0f1ec5ae39b6ac750a001d313bb3617e262bd4422041ec5e5592cf3b
SHA512524404564fba7cbb777bcd28d3688a161ffc033d18d2f9de7d910e6c28435bf3f8019312357952991e3d93040c16cbea6c244ac0959d0d5e35d38122cb9a1838