Analysis
-
max time kernel
152s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe
-
Size
192KB
-
MD5
58a5631d4e9fd96ef41c34365d2f73f0
-
SHA1
a41e0a9364b7abfc110b45f743f9024d98437425
-
SHA256
40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68
-
SHA512
3ad2cf3d9ee849c8ea329014e9ea1e6823db326ece95131f67fce8a4763644b1a2c9cf2193a5f2abbe89f0d1d5fc1dbe05d65a86e7b610e817267c64ca761b6f
-
SSDEEP
1536:tFcF2Oar4aaaaat031AdQWB5kCFrWszRUOHFlQhzyLwVKftfVBiZHAPloFp5A2mJ:vOdW3kCFrWsF2eLbqx2694sU9
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tuuwia.exe -
Executes dropped EXE 1 IoCs
pid Process 4312 tuuwia.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /v" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /r" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /p" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /a" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /d" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /f" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /y" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /q" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /w" 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /m" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /k" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /n" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /e" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /b" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /i" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /s" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /j" tuuwia.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /c" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /x" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /u" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /z" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /l" tuuwia.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /w" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /h" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /o" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /g" tuuwia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuuwia = "C:\\Users\\Admin\\tuuwia.exe /t" tuuwia.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe 2040 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe 4312 tuuwia.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2040 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe 4312 tuuwia.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2040 wrote to memory of 4312 2040 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe 86 PID 2040 wrote to memory of 4312 2040 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe 86 PID 2040 wrote to memory of 4312 2040 40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe"C:\Users\Admin\AppData\Local\Temp\40357a5368864b170a55d04f4979d54b1a348ce1213169c4bd07d5a08088cc68.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\tuuwia.exe"C:\Users\Admin\tuuwia.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4312
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5db5d81d7255118d082be21c624683f9b
SHA1cd1af6004304ac2854274c5785fe4f73c27d850d
SHA2563b8df1949a92f623708335ef2a3fd2bd7d3f7b6c6df09bbe24ab1138065fe45e
SHA512b97ad06be16266ecc9833fbf856a79245cdbcbb1e9cbfae854e681c6bc40be5cef1a513765d9386227962f2880cacdb42c4094f1b0672c7a0dd1dc01349c8427
-
Filesize
192KB
MD5db5d81d7255118d082be21c624683f9b
SHA1cd1af6004304ac2854274c5785fe4f73c27d850d
SHA2563b8df1949a92f623708335ef2a3fd2bd7d3f7b6c6df09bbe24ab1138065fe45e
SHA512b97ad06be16266ecc9833fbf856a79245cdbcbb1e9cbfae854e681c6bc40be5cef1a513765d9386227962f2880cacdb42c4094f1b0672c7a0dd1dc01349c8427