Analysis
-
max time kernel
151s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe
-
Size
212KB
-
MD5
6212729be1fa171c7b5a704e501fd6a3
-
SHA1
bc39007f3d0b342560b3fb6642eed05efae3f37d
-
SHA256
18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042
-
SHA512
e565b783579e4948228aaeb9af2b3d0adf4f3a9de4338989a7e95e62e97b23e486618675a539c187b20987e7fb89b832ae7c3d7c51d5e7246d9b436956ffb83f
-
SSDEEP
3072:ZJWf33OCzgWNcssT2SSXzBNVATA9ZpqT4c36I/odrb/q:ZJggWRsTKBNVATA9Z885tdf/q
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" foiiyow.exe -
Executes dropped EXE 1 IoCs
pid Process 948 foiiyow.exe -
Loads dropped DLL 2 IoCs
pid Process 912 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe 912 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /B" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /F" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /h" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /x" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /e" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /U" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /N" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /w" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /L" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /g" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /a" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /I" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /d" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /H" 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /l" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /z" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /f" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /O" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /u" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /G" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /Y" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /M" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /C" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /q" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /S" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /Q" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /A" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /t" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /D" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /Z" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /R" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /o" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /E" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /s" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /b" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /T" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /P" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /K" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /V" foiiyow.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /c" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /y" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /W" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /i" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /p" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /X" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /r" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /H" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /n" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /j" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /v" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /m" foiiyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\foiiyow = "C:\\Users\\Admin\\foiiyow.exe /J" foiiyow.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe 948 foiiyow.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 912 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe 948 foiiyow.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 912 wrote to memory of 948 912 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe 27 PID 912 wrote to memory of 948 912 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe 27 PID 912 wrote to memory of 948 912 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe 27 PID 912 wrote to memory of 948 912 18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe"C:\Users\Admin\AppData\Local\Temp\18c3d59860d21348e2338ecc96e620479cda1a7513e1034791eaac33aa10f042.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\foiiyow.exe"C:\Users\Admin\foiiyow.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD58435e7560a36bb4adf5ca603e7c00a32
SHA13b543876f6da7b25f132e1c6ff96f00c3f6fae1d
SHA256bbb3346dafe6cf44f0f77508f6e7d4a4cac4a51257fc2c13594170e545177bb7
SHA51289373fd8465d1dd0636e3eb9f557d4bdf09663a56d1e78073e44dc2fe1cb6ec0436b54ba234d16e03554bf040053ecaaa1c0630c7e4791ac7f46b7e7a1852850
-
Filesize
212KB
MD58435e7560a36bb4adf5ca603e7c00a32
SHA13b543876f6da7b25f132e1c6ff96f00c3f6fae1d
SHA256bbb3346dafe6cf44f0f77508f6e7d4a4cac4a51257fc2c13594170e545177bb7
SHA51289373fd8465d1dd0636e3eb9f557d4bdf09663a56d1e78073e44dc2fe1cb6ec0436b54ba234d16e03554bf040053ecaaa1c0630c7e4791ac7f46b7e7a1852850
-
Filesize
212KB
MD58435e7560a36bb4adf5ca603e7c00a32
SHA13b543876f6da7b25f132e1c6ff96f00c3f6fae1d
SHA256bbb3346dafe6cf44f0f77508f6e7d4a4cac4a51257fc2c13594170e545177bb7
SHA51289373fd8465d1dd0636e3eb9f557d4bdf09663a56d1e78073e44dc2fe1cb6ec0436b54ba234d16e03554bf040053ecaaa1c0630c7e4791ac7f46b7e7a1852850
-
Filesize
212KB
MD58435e7560a36bb4adf5ca603e7c00a32
SHA13b543876f6da7b25f132e1c6ff96f00c3f6fae1d
SHA256bbb3346dafe6cf44f0f77508f6e7d4a4cac4a51257fc2c13594170e545177bb7
SHA51289373fd8465d1dd0636e3eb9f557d4bdf09663a56d1e78073e44dc2fe1cb6ec0436b54ba234d16e03554bf040053ecaaa1c0630c7e4791ac7f46b7e7a1852850