Analysis
- max time kernel
168s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
03/10/2022, 16:34
Static task
static1
Behavioral task
behavioral1
Sample
1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe
- Size 180KB
- Sample221003-t283gafaa6
- SHA256 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b
- MD5 0434eaae379fa01ae598f8cc3f9613c0
- SHA1 b48cdb5f222a1f895dcd591c71efc8d863c211b7
- SHA512 8af312f1ddb3eb5c5b0b13f91dfa32c16a8e4bc09765b7b89dbbdf5e875f9b87a7d7b34db8010ddc66a452faee18efdd1caebd2f43ec2831d2b2a44dccb5a0e5
- SSDEEP 3072:ZyYdVAXY71idPAaWELGzMshNXTDFE+7jF6XTrE:ZyYzAY+oXqFshNTDT756XT
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" beoigos.exe - Executes dropped EXE 1 IoCs
pid Process 3356 beoigos.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe - Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /t" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /j" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /f" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /k" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /d" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /u" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /j" 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /o" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /p" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /n" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /i" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /s" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /m" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /g" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /h" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /w" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /b" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /z" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /e" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /y" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /c" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /x" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /r" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /v" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /a" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /l" beoigos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoigos = "C:\\Users\\Admin\\beoigos.exe /q" beoigos.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4160 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe 4160 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe 3356 beoigos.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4160 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe 3356 beoigos.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4160 wrote to memory of 3356 4160 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe 83 PID 4160 wrote to memory of 3356 4160 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe 83 PID 4160 wrote to memory of 3356 4160 1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe"C:\Users\Admin\AppData\Local\Temp\1637998e5cbfb9bb5a203786ab18cd0b251e95bcec950698986c3ee35a71106b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\beoigos.exe"C:\Users\Admin\beoigos.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3356
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\beoigos.exe
- Size 180KB
- SHA256 f0c4ce43430f93f2b5319428cfe61bb6b2c6305c39ea10f9785cfebca8306e30
- MD5 34e93147f85f2e2d87e6a08a8a6c3e36
- SHA1 f8a243e5f62ca5d22d557799cb54fd6207ceb642
- SHA512 3e2391fa68b42a85fd8f74f67f91365df49c4aef0868803469cfbb57fb2a7d19086f44ef56a4afbe484ab818e385c2635f7e680909c338d246000fc374fdc215
- SSDEEP 3072:ZyxdVAXY71idPAaWELGzMshNXTDFE+7jF6XTEj:ZyxzAY+oXqFshNTDT756XT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\beoigos.exe
- Size 180KB
- SHA256 f0c4ce43430f93f2b5319428cfe61bb6b2c6305c39ea10f9785cfebca8306e30
- MD5 34e93147f85f2e2d87e6a08a8a6c3e36
- SHA1 f8a243e5f62ca5d22d557799cb54fd6207ceb642
- SHA512 3e2391fa68b42a85fd8f74f67f91365df49c4aef0868803469cfbb57fb2a7d19086f44ef56a4afbe484ab818e385c2635f7e680909c338d246000fc374fdc215
- SSDEEP 3072:ZyxdVAXY71idPAaWELGzMshNXTDFE+7jF6XTEj:ZyxzAY+oXqFshNTDT756XT
- MD5 SHA1 SHA512 SSDEEP