Analysis
-
max time kernel
172s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 15:39
Static task
static1
Behavioral task
behavioral1
Sample
4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe
-
Size
44KB
-
MD5
6fd227393559d433e182ec997fd24f91
-
SHA1
2e33f9871064f94dd25625e70ed6f67eca479431
-
SHA256
4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e
-
SHA512
94dc6c31b112f571edca9b52106c2f83a2c108436d99154dac5e605f96381143dce527c84198af795cfdf92d1c02b04d366511c5c8ce6dac4ce442484dc04b7e
-
SSDEEP
768:DTU/Hd+97h/uXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:DT3dHyj6S3T77
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pjsieq.exe -
Executes dropped EXE 1 IoCs
pid Process 1908 pjsieq.exe -
Loads dropped DLL 2 IoCs
pid Process 1460 4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe 1460 4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ pjsieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\pjsieq = "C:\\Users\\Admin\\pjsieq.exe" pjsieq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe 1908 pjsieq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1460 4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe 1908 pjsieq.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1908 1460 4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe 28 PID 1460 wrote to memory of 1908 1460 4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe 28 PID 1460 wrote to memory of 1908 1460 4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe 28 PID 1460 wrote to memory of 1908 1460 4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe 28 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13 PID 1908 wrote to memory of 1460 1908 pjsieq.exe 13
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe"C:\Users\Admin\AppData\Local\Temp\4e1a13e75728e39d42c7379348e252b74e42aac630915d36178adc9767b0e55e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\pjsieq.exe"C:\Users\Admin\pjsieq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD51ad1e94bc5311e5b134627a1fd6e5da9
SHA1d9a91f90ce50dd6e6ce83cd7962e1e5ba510e0c9
SHA256e4ffd6b0ae5d62827635cda9266f08330d74e0bc1189dc972324b5e702be4e17
SHA512691f043932472360c02b5bc7fac7a8104d9a763588ebfaa3f553320debb7f4183aebe2048418579dbffab0d5b5ab85104d9701badbc9db7ec43d3c6089ed2830
-
Filesize
44KB
MD51ad1e94bc5311e5b134627a1fd6e5da9
SHA1d9a91f90ce50dd6e6ce83cd7962e1e5ba510e0c9
SHA256e4ffd6b0ae5d62827635cda9266f08330d74e0bc1189dc972324b5e702be4e17
SHA512691f043932472360c02b5bc7fac7a8104d9a763588ebfaa3f553320debb7f4183aebe2048418579dbffab0d5b5ab85104d9701badbc9db7ec43d3c6089ed2830
-
Filesize
44KB
MD51ad1e94bc5311e5b134627a1fd6e5da9
SHA1d9a91f90ce50dd6e6ce83cd7962e1e5ba510e0c9
SHA256e4ffd6b0ae5d62827635cda9266f08330d74e0bc1189dc972324b5e702be4e17
SHA512691f043932472360c02b5bc7fac7a8104d9a763588ebfaa3f553320debb7f4183aebe2048418579dbffab0d5b5ab85104d9701badbc9db7ec43d3c6089ed2830
-
Filesize
44KB
MD51ad1e94bc5311e5b134627a1fd6e5da9
SHA1d9a91f90ce50dd6e6ce83cd7962e1e5ba510e0c9
SHA256e4ffd6b0ae5d62827635cda9266f08330d74e0bc1189dc972324b5e702be4e17
SHA512691f043932472360c02b5bc7fac7a8104d9a763588ebfaa3f553320debb7f4183aebe2048418579dbffab0d5b5ab85104d9701badbc9db7ec43d3c6089ed2830