Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 20:15
Static task
static1
Behavioral task
behavioral1
Sample
81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe
-
Size
192KB
-
MD5
68796c110ad7b6142142790f5e4084d0
-
SHA1
7d63d01f6bfdb3ace553b15cbe4e2315ad11b729
-
SHA256
81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55
-
SHA512
4892ba3ea9cfbf43bdc0b32e72298cb1b9bb96749a6eb4ab74bbb1dde64377825da4439fa3cf7983ceced810e41014d2a0b1e11a7a33e16a036a36ad44b42080
-
SSDEEP
1536:ffHmH9uHl9jwPRi4iti93MH9iV6MRfWzzp3BHCeQbIYL29oPLJZ514R9/77rqiaW:3mH9a92Ri4itiSHXzp3fYhPLJG1aW
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" noedi.exe -
Executes dropped EXE 1 IoCs
pid Process 1200 noedi.exe -
Loads dropped DLL 2 IoCs
pid Process 1600 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe 1600 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /f" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /j" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /i" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /l" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /e" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /c" noedi.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /d" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /t" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /y" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /z" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /q" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /n" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /k" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /w" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /a" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /r" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /x" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /s" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /g" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /p" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /o" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /m" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /u" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /h" noedi.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /v" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /b" noedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\noedi = "C:\\Users\\Admin\\noedi.exe /x" 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1600 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe 1200 noedi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1600 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe 1200 noedi.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1200 1600 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe 27 PID 1600 wrote to memory of 1200 1600 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe 27 PID 1600 wrote to memory of 1200 1600 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe 27 PID 1600 wrote to memory of 1200 1600 81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe"C:\Users\Admin\AppData\Local\Temp\81300e4004f17de0b1b1ab9d1d5a75ac56ae176aba0823a352a222e54ea5ab55.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\noedi.exe"C:\Users\Admin\noedi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1200
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD529b475555be3d467f4800d4f1a99f922
SHA1bf3e315d610dded34e98512e739da65bfa64e0ad
SHA256e319331a300e1d217c2110516d16539078277c735f6e5fa9bc1b767e659abfbf
SHA512867e1ad9145a9cb6237f379d8d240b313d450e5c139587a1d3c9445f4448cacf08d3f62ba0e3b4cf9061b6ebd2429fec0d0611bb110d42752f5ce8b002b215fd
-
Filesize
192KB
MD529b475555be3d467f4800d4f1a99f922
SHA1bf3e315d610dded34e98512e739da65bfa64e0ad
SHA256e319331a300e1d217c2110516d16539078277c735f6e5fa9bc1b767e659abfbf
SHA512867e1ad9145a9cb6237f379d8d240b313d450e5c139587a1d3c9445f4448cacf08d3f62ba0e3b4cf9061b6ebd2429fec0d0611bb110d42752f5ce8b002b215fd
-
Filesize
192KB
MD529b475555be3d467f4800d4f1a99f922
SHA1bf3e315d610dded34e98512e739da65bfa64e0ad
SHA256e319331a300e1d217c2110516d16539078277c735f6e5fa9bc1b767e659abfbf
SHA512867e1ad9145a9cb6237f379d8d240b313d450e5c139587a1d3c9445f4448cacf08d3f62ba0e3b4cf9061b6ebd2429fec0d0611bb110d42752f5ce8b002b215fd
-
Filesize
192KB
MD529b475555be3d467f4800d4f1a99f922
SHA1bf3e315d610dded34e98512e739da65bfa64e0ad
SHA256e319331a300e1d217c2110516d16539078277c735f6e5fa9bc1b767e659abfbf
SHA512867e1ad9145a9cb6237f379d8d240b313d450e5c139587a1d3c9445f4448cacf08d3f62ba0e3b4cf9061b6ebd2429fec0d0611bb110d42752f5ce8b002b215fd