Analysis
-
max time kernel
151s -
max time network
68s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 20:19
Static task
static1
Behavioral task
behavioral1
Sample
528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe
-
Size
208KB
-
MD5
6eac270f7b7e03d33a6b3bfb2293e740
-
SHA1
b4f6d168a910d3994cdeb160190de01f5f1814d9
-
SHA256
528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d
-
SHA512
6a76f8951cc0106d81ae98c1015e385ac0b8b08e017c1306d1b0e8945f9a886ca9fa01a583e45d2102fba36eb01d9730b457acf778c376e60d8a2ad0f7d1a178
-
SSDEEP
3072:nPD2eT5nWYPNr4Xyl+swASQMy6nl+yN4Bd:VdHPNAst/L
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" luacui.exe -
Executes dropped EXE 1 IoCs
pid Process 1988 luacui.exe -
Loads dropped DLL 2 IoCs
pid Process 1684 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe 1684 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /k" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /q" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /u" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /w" luacui.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /l" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /b" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /o" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /z" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /d" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /i" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /f" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /a" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /j" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /x" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /r" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /m" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /t" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /h" luacui.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /s" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /c" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /n" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /p" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /e" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /g" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /y" luacui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /t" 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\luacui = "C:\\Users\\Admin\\luacui.exe /v" luacui.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe 1988 luacui.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1684 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe 1988 luacui.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1988 1684 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe 28 PID 1684 wrote to memory of 1988 1684 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe 28 PID 1684 wrote to memory of 1988 1684 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe 28 PID 1684 wrote to memory of 1988 1684 528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe"C:\Users\Admin\AppData\Local\Temp\528aafa687a4d16cebcee9f7283ac033e3bdfa6a0ab4de9f1ad1886960f7fd6d.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\luacui.exe"C:\Users\Admin\luacui.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1988
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD59f0da42b373fae57da3661800e3c3687
SHA13f68ebe4bc7935097c744c0611da69a4e9f23e96
SHA2561af7db7e7fd4d6e14736b013ec40badf67a5a10ba0c9865953edee0e40aaa8d3
SHA512d6cc9c8e5d7c5f7809212d0e145bd1fbbe6bed8329d0c052cb7429844996b045036cfc3e6469a3fe3122ec1dbe866a889c1df660799dcb8ff2361500f431fd7c
-
Filesize
208KB
MD59f0da42b373fae57da3661800e3c3687
SHA13f68ebe4bc7935097c744c0611da69a4e9f23e96
SHA2561af7db7e7fd4d6e14736b013ec40badf67a5a10ba0c9865953edee0e40aaa8d3
SHA512d6cc9c8e5d7c5f7809212d0e145bd1fbbe6bed8329d0c052cb7429844996b045036cfc3e6469a3fe3122ec1dbe866a889c1df660799dcb8ff2361500f431fd7c
-
Filesize
208KB
MD59f0da42b373fae57da3661800e3c3687
SHA13f68ebe4bc7935097c744c0611da69a4e9f23e96
SHA2561af7db7e7fd4d6e14736b013ec40badf67a5a10ba0c9865953edee0e40aaa8d3
SHA512d6cc9c8e5d7c5f7809212d0e145bd1fbbe6bed8329d0c052cb7429844996b045036cfc3e6469a3fe3122ec1dbe866a889c1df660799dcb8ff2361500f431fd7c
-
Filesize
208KB
MD59f0da42b373fae57da3661800e3c3687
SHA13f68ebe4bc7935097c744c0611da69a4e9f23e96
SHA2561af7db7e7fd4d6e14736b013ec40badf67a5a10ba0c9865953edee0e40aaa8d3
SHA512d6cc9c8e5d7c5f7809212d0e145bd1fbbe6bed8329d0c052cb7429844996b045036cfc3e6469a3fe3122ec1dbe866a889c1df660799dcb8ff2361500f431fd7c