Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 03:03
Static task
static1
Behavioral task
behavioral1
Sample
478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe
Resource
win10v2004-20220812-en
General
-
Target
478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe
-
Size
164KB
-
MD5
601957ad3967f7c2456a619bb4772bc0
-
SHA1
03a52842abd2f7126308642541fafdef5200559f
-
SHA256
478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c
-
SHA512
35a024475095573edc8d5cbd0127a3f47ad92958ec81b5183a93897fbc9ee18a9acac385f2b7acd6eafa7250778e4b9de0c6f295b02362db18c3814b5be3bf77
-
SSDEEP
3072:hsUaAUAatoYj3Bc8T828UAw1XiazCgaN8L2YAgt4oQZiE0O:gAxNaxc8Y28I1XiUq8sg/Wn
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exedoubauz.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" doubauz.exe -
Executes dropped EXE 1 IoCs
Processes:
doubauz.exepid process 1340 doubauz.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe -
Adds Run key to start application 2 TTPs 54 IoCs
Processes:
doubauz.exe478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /h" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /e" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /z" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /Z" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /Q" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /m" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /X" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /j" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /I" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /A" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /C" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /a" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /M" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /U" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /L" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /W" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /V" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /T" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /i" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /O" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /K" 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /r" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /H" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /f" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /D" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /K" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /G" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /b" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /c" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /p" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /v" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /Y" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /q" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /d" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /E" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /k" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /S" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /w" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /P" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /u" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /B" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /s" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /o" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /l" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /J" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /n" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /N" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /R" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /y" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /g" doubauz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /F" doubauz.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doubauz = "C:\\Users\\Admin\\doubauz.exe /t" doubauz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exedoubauz.exepid process 4112 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe 4112 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe 1340 doubauz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exedoubauz.exepid process 4112 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe 1340 doubauz.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exedescription pid process target process PID 4112 wrote to memory of 1340 4112 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe doubauz.exe PID 4112 wrote to memory of 1340 4112 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe doubauz.exe PID 4112 wrote to memory of 1340 4112 478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe doubauz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe"C:\Users\Admin\AppData\Local\Temp\478c0fef9ae3f24eb10a7efb98f3eee21a0ea0fd0c01a78c14d6703e737c469c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\doubauz.exe"C:\Users\Admin\doubauz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\doubauz.exeFilesize
164KB
MD5a8bd5db5b0fd427a027dc72d1e432c3a
SHA172d6d6080f83e910f6abf002a7f7f28001c2789b
SHA256fa17b629132b775230a508d232f16a007ec5e33e04b750ebbb249f9a9e29e64b
SHA512ceb14f55b4bd21fc5f155c488a311c64da0c685d696c79f4bb6674305a8a2223768c1fd6f7bb0e5d6207d424042b6bf43ace254164467e6a3273310e897f6327
-
C:\Users\Admin\doubauz.exeFilesize
164KB
MD5a8bd5db5b0fd427a027dc72d1e432c3a
SHA172d6d6080f83e910f6abf002a7f7f28001c2789b
SHA256fa17b629132b775230a508d232f16a007ec5e33e04b750ebbb249f9a9e29e64b
SHA512ceb14f55b4bd21fc5f155c488a311c64da0c685d696c79f4bb6674305a8a2223768c1fd6f7bb0e5d6207d424042b6bf43ace254164467e6a3273310e897f6327
-
memory/1340-134-0x0000000000000000-mapping.dmp