Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 02:43
Static task
static1
Behavioral task
behavioral1
Sample
b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe
-
Size
80KB
-
MD5
5d2b4096047dda68439cdfe97f3a44a3
-
SHA1
3d939cffdf1647de5597bee2b789de6f69ba3ce2
-
SHA256
b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d
-
SHA512
d3049c936f7285511faf593324e80eda9433580d22340bc7edb2ae321517333a53a2805745ab9bc5f2047fa011e264d387d5eac7c7260e5d948fa05e22fe7f88
-
SSDEEP
1536:Dcdq456g7LWnICOqubrsHpwFJ0T72mocT:456dIVqvuFJ0T72mBT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zrfuw.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe -
Executes dropped EXE 1 IoCs
pid Process 988 zrfuw.exe -
Loads dropped DLL 2 IoCs
pid Process 1788 b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe 1788 b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /b" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /w" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /e" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /z" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /l" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /n" zrfuw.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /i" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /u" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /t" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /h" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /j" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /d" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /y" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /k" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /v" zrfuw.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /k" b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /x" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /o" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /c" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /p" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /a" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /s" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /m" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /r" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /g" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /f" zrfuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zrfuw = "C:\\Users\\Admin\\zrfuw.exe /q" zrfuw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1788 b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe 988 zrfuw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1788 b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe 988 zrfuw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1788 wrote to memory of 988 1788 b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe 28 PID 1788 wrote to memory of 988 1788 b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe 28 PID 1788 wrote to memory of 988 1788 b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe 28 PID 1788 wrote to memory of 988 1788 b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe"C:\Users\Admin\AppData\Local\Temp\b0089795b7a8069bf8a139b6dd380488ec45775dc7b5708bcc38302b17d05b4d.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\zrfuw.exe"C:\Users\Admin\zrfuw.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:988
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5b5c1a8664ab305f1a0e5c4481e475e3b
SHA17d1665ffe57b2fb76557959ec31dfa813fb5b524
SHA25657479da89e688162ed9aedbc3334f1707815db99baff501b1dfe1ae6dd2e2aa9
SHA512bcd90f58dda8086308c6897b0a91f45ce4f7a237d687d6871e9d1b20864c8e8878053fa0833042691072adac4fe16101169563c26c9e186ed44ed4694e3e1ab0
-
Filesize
80KB
MD5b5c1a8664ab305f1a0e5c4481e475e3b
SHA17d1665ffe57b2fb76557959ec31dfa813fb5b524
SHA25657479da89e688162ed9aedbc3334f1707815db99baff501b1dfe1ae6dd2e2aa9
SHA512bcd90f58dda8086308c6897b0a91f45ce4f7a237d687d6871e9d1b20864c8e8878053fa0833042691072adac4fe16101169563c26c9e186ed44ed4694e3e1ab0
-
Filesize
80KB
MD5b5c1a8664ab305f1a0e5c4481e475e3b
SHA17d1665ffe57b2fb76557959ec31dfa813fb5b524
SHA25657479da89e688162ed9aedbc3334f1707815db99baff501b1dfe1ae6dd2e2aa9
SHA512bcd90f58dda8086308c6897b0a91f45ce4f7a237d687d6871e9d1b20864c8e8878053fa0833042691072adac4fe16101169563c26c9e186ed44ed4694e3e1ab0
-
Filesize
80KB
MD5b5c1a8664ab305f1a0e5c4481e475e3b
SHA17d1665ffe57b2fb76557959ec31dfa813fb5b524
SHA25657479da89e688162ed9aedbc3334f1707815db99baff501b1dfe1ae6dd2e2aa9
SHA512bcd90f58dda8086308c6897b0a91f45ce4f7a237d687d6871e9d1b20864c8e8878053fa0833042691072adac4fe16101169563c26c9e186ed44ed4694e3e1ab0