Analysis
-
max time kernel
174s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe
-
Size
212KB
-
MD5
155a02e1532f610af62e696723d41980
-
SHA1
a2dd3920ffa53a96f38e2b0f3f21a9537c62aff6
-
SHA256
1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d
-
SHA512
ffeb286e0d13b7d8160ff17895ae53c47bd4f46efd519bcd3777f197331fe36b7f66e5f16c1d25208b4fe141c3cb62e61e5ea30487d0251c19794c7017650eea
-
SSDEEP
6144:68AKwwP6iczY09umHh7K5cUXEBwrYVHhAgY61cD:TAby6xY09umH45cUXEBwUVHhAgY61U
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vekuf.exe -
Executes dropped EXE 1 IoCs
pid Process 4160 vekuf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe -
Adds Run key to start application 2 TTPs 58 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /p" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /q" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /n" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /s" 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /p" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /s" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /i" 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /m" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /t" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /v" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /x" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /j" vekuf.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /t" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /a" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /i" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /f" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /e" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /o" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /u" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /n" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /s" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /e" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /r" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /v" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /o" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /k" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /z" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /b" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /m" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /w" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /b" vekuf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /f" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /i" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /k" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /r" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /y" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /l" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /c" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /a" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /u" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /l" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /h" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /g" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /h" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /x" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /z" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /d" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /y" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /d" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /w" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /j" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /q" vekuf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /g" vekuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vekuf = "C:\\Users\\Admin\\vekuf.exe /c" vekuf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 440 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe 440 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe 4160 vekuf.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4160 vekuf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 440 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe 4160 vekuf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 440 wrote to memory of 4160 440 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe 83 PID 440 wrote to memory of 4160 440 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe 83 PID 440 wrote to memory of 4160 440 1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe"C:\Users\Admin\AppData\Local\Temp\1873ebda58026d880be7c1a242a0981da8efd57ccc381456baf2939d17cc146d.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\vekuf.exe"C:\Users\Admin\vekuf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4160
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD547422bcbe28cb74ecbc7b2ec5bdc29cb
SHA17de2f4f3f580b22790d185ed76074e82edb94ad0
SHA256ac5789e0e74f60fa50c1aa0800f90ca87d0c7e14333ad65d2c2d273ddec3a2dc
SHA512836fa3b61824636ef1c981f2d2d5f9d45c7e17c35cb12dccfc0c4e25bece49d008564cf187b06ad5c87585bb71a89fb2eeee7c5c841c642716853106a61ab9fa
-
Filesize
212KB
MD547422bcbe28cb74ecbc7b2ec5bdc29cb
SHA17de2f4f3f580b22790d185ed76074e82edb94ad0
SHA256ac5789e0e74f60fa50c1aa0800f90ca87d0c7e14333ad65d2c2d273ddec3a2dc
SHA512836fa3b61824636ef1c981f2d2d5f9d45c7e17c35cb12dccfc0c4e25bece49d008564cf187b06ad5c87585bb71a89fb2eeee7c5c841c642716853106a61ab9fa