Analysis
-
max time kernel
158s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 07:27
Static task
static1
Behavioral task
behavioral1
Sample
e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe
Resource
win10v2004-20220812-en
General
-
Target
e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe
-
Size
244KB
-
MD5
2f3421d7257c9408476def4b6992346a
-
SHA1
baa4ab526fa50bd895e732ecff1362ae1491d6f6
-
SHA256
e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3
-
SHA512
495d1ced30c6d4ba961d60df4c0036cf03eb0e6a7872736c5315a0070968536fb5a945575a3fdff1c01186c69232f8b938c4398a86bb4acd41b88ca696f9db2f
-
SSDEEP
6144:djiQ+u5HAPkbZePJDmlI/+dfkIOwgccXYJcmI3cvHQOFZayUa/nM21:piQ+u5HAPk9EUoYJcmym0K
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" poiyo.exe -
Executes dropped EXE 1 IoCs
pid Process 684 poiyo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /t" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /C" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /k" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /O" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /Z" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /X" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /f" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /K" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /r" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /b" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /B" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /n" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /c" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /i" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /g" poiyo.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /T" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /y" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /V" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /W" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /E" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /j" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /N" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /z" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /G" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /q" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /Q" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /H" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /d" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /I" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /M" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /S" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /F" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /v" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /U" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /J" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /p" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /e" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /a" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /h" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /l" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /R" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /s" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /L" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /m" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /x" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /D" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /w" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /P" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /o" poiyo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poiyo = "C:\\Users\\Admin\\poiyo.exe /Y" poiyo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe 684 poiyo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3372 e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe 684 poiyo.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3372 wrote to memory of 684 3372 e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe 87 PID 3372 wrote to memory of 684 3372 e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe 87 PID 3372 wrote to memory of 684 3372 e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe"C:\Users\Admin\AppData\Local\Temp\e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\poiyo.exe"C:\Users\Admin\poiyo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:684
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD560cbd64e825004e1c222774db091dd05
SHA184cc763b2300653443c55e09f582a0e1a1c8fe18
SHA256a65f83d89cbcada4b7660454bf66695964ba53b418240ad40001173ce0a2d1da
SHA5122b2da8ae4134990b8e21b83a644309a1d6cafff2a22f25ba1fe8300a6d7aca6c1b4093cb8560d9a47f42f0116460b5d044c38037690cd28699fa44019dd4a2d6
-
Filesize
244KB
MD560cbd64e825004e1c222774db091dd05
SHA184cc763b2300653443c55e09f582a0e1a1c8fe18
SHA256a65f83d89cbcada4b7660454bf66695964ba53b418240ad40001173ce0a2d1da
SHA5122b2da8ae4134990b8e21b83a644309a1d6cafff2a22f25ba1fe8300a6d7aca6c1b4093cb8560d9a47f42f0116460b5d044c38037690cd28699fa44019dd4a2d6