Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2022 20:19
Static task
static1
Behavioral task
behavioral1
Sample
4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe
-
Size
100KB
-
MD5
778e44b66e32598380ca264fcfaae920
-
SHA1
c50b08ddd8375604e9b6187c02c4ecc9a85cd5a8
-
SHA256
4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f
-
SHA512
72cb5b3a0fb51331d4c514025ef934856be56847fcb752877e5ceb512c4fa2d00a58065497372fc30f49dd799b5c6d74f7bb21ccff467753a14c5fd4745fad27
-
SSDEEP
1536:Si28iAuismywsfHWlLw0wF9MGM9K/oKtNgCMbA1bL3N+NM5UfONIjnZ0h:+f+/KLOM5FCnKh
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" decid.exe -
Executes dropped EXE 1 IoCs
pid Process 4180 decid.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /p" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /T" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /j" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /a" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /h" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /Y" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /B" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /C" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /G" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /f" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /J" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /x" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /K" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /l" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /k" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /t" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /r" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /X" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /y" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /i" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /o" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /n" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /I" decid.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /g" decid.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /L" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /N" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /U" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /c" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /E" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /Q" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /H" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /M" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /P" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /b" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /m" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /z" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /D" 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /O" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /w" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /u" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /D" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /W" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /Z" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /v" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /S" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /s" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /d" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /R" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /A" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /e" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /F" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /q" decid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decid = "C:\\Users\\Admin\\decid.exe /V" decid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3496 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe 3496 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe 4180 decid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3496 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe 4180 decid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3496 wrote to memory of 4180 3496 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe 86 PID 3496 wrote to memory of 4180 3496 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe 86 PID 3496 wrote to memory of 4180 3496 4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe"C:\Users\Admin\AppData\Local\Temp\4fa28ad7a3c444e01e4ffd9960a7a2170c396b1fe49700153d3da00c12ec552f.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\decid.exe"C:\Users\Admin\decid.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4180
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5460a1b71d0a2dfbec8bbb06350b1fb2c
SHA163cfcb6e0c31be1d555154b3f130f761eff07b75
SHA256c514f1923d0e745c87536f8208833e9ce0ef4f3d852f93aeea6c0c98567e9665
SHA51248420aa3d1e162eaf7b0607e7948606ae36abca9f92fff5fa37756cd8ff95e117ca40a085c351778610764a66b1a94e6899577f9b71245602f868c5d253da5af
-
Filesize
100KB
MD5460a1b71d0a2dfbec8bbb06350b1fb2c
SHA163cfcb6e0c31be1d555154b3f130f761eff07b75
SHA256c514f1923d0e745c87536f8208833e9ce0ef4f3d852f93aeea6c0c98567e9665
SHA51248420aa3d1e162eaf7b0607e7948606ae36abca9f92fff5fa37756cd8ff95e117ca40a085c351778610764a66b1a94e6899577f9b71245602f868c5d253da5af