Analysis
-
max time kernel
153s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 21:50
Static task
static1
Behavioral task
behavioral1
Sample
5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe
-
Size
380KB
-
MD5
3a9de56ed60853cab3513769a97152f0
-
SHA1
4eee8e477a80d60214196619baeeec31e0c7f08b
-
SHA256
5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0
-
SHA512
0ad979bdebbe4c93b79e9bee2fa3b2e6b5fac7dcad0eead50336c52a00e8f3a8b9658f2158c48c58af11774fc9cb8054dc560927883bf56544f02e6d8ae65743
-
SSDEEP
6144:MTcFZVYD3a/guRyxxgKK/qF3AAiezqDBGv6Nlr:DVYTa/gxxgK3QLDB5B
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wtbux.exe -
Executes dropped EXE 1 IoCs
pid Process 1360 wtbux.exe -
Loads dropped DLL 2 IoCs
pid Process 696 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe 696 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /l" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /v" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /M" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /F" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /j" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /z" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /m" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /B" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /u" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /e" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /J" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /g" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /U" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /P" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /V" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /a" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /c" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /r" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /K" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /X" wtbux.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /A" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /E" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /t" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /W" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /q" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /D" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /S" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /i" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /o" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /Y" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /s" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /R" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /H" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /L" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /N" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /G" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /Z" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /k" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /h" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /Q" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /C" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /b" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /d" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /R" 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /f" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /T" wtbux.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /O" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /n" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /p" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /w" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /I" wtbux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtbux = "C:\\Users\\Admin\\wtbux.exe /x" wtbux.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 696 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe 1360 wtbux.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 696 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe 1360 wtbux.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 696 wrote to memory of 1360 696 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe 28 PID 696 wrote to memory of 1360 696 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe 28 PID 696 wrote to memory of 1360 696 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe 28 PID 696 wrote to memory of 1360 696 5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe"C:\Users\Admin\AppData\Local\Temp\5de07968a00f7e100e7aee7b1b074e683796fd00f4045ed8d9ae8a52bb7fb9f0.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\wtbux.exe"C:\Users\Admin\wtbux.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1360
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD58a59f5441b3680f085674a14c0e83b6e
SHA137638b22d86cd64def15d34be1e5c7de3a15b415
SHA25644fd58c479023b70ab894180c451e6eff3aff17076ac636adf68f747f25e18a5
SHA51286300913a303d6f4853355e71e93603b4052693e7d5a871c5540991da742221bb08b7beed854307099342130e6532c02f7c11a8657db4f8460ff55f64d67b196
-
Filesize
380KB
MD58a59f5441b3680f085674a14c0e83b6e
SHA137638b22d86cd64def15d34be1e5c7de3a15b415
SHA25644fd58c479023b70ab894180c451e6eff3aff17076ac636adf68f747f25e18a5
SHA51286300913a303d6f4853355e71e93603b4052693e7d5a871c5540991da742221bb08b7beed854307099342130e6532c02f7c11a8657db4f8460ff55f64d67b196
-
Filesize
380KB
MD58a59f5441b3680f085674a14c0e83b6e
SHA137638b22d86cd64def15d34be1e5c7de3a15b415
SHA25644fd58c479023b70ab894180c451e6eff3aff17076ac636adf68f747f25e18a5
SHA51286300913a303d6f4853355e71e93603b4052693e7d5a871c5540991da742221bb08b7beed854307099342130e6532c02f7c11a8657db4f8460ff55f64d67b196
-
Filesize
380KB
MD58a59f5441b3680f085674a14c0e83b6e
SHA137638b22d86cd64def15d34be1e5c7de3a15b415
SHA25644fd58c479023b70ab894180c451e6eff3aff17076ac636adf68f747f25e18a5
SHA51286300913a303d6f4853355e71e93603b4052693e7d5a871c5540991da742221bb08b7beed854307099342130e6532c02f7c11a8657db4f8460ff55f64d67b196