Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 20:49
Static task
static1
Behavioral task
behavioral1
Sample
1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe
-
Size
77KB
-
MD5
788959c25df4e1f8c55f524c1639eaba
-
SHA1
37bf65009a6a191a06aa3486c48b69157be5f495
-
SHA256
1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f
-
SHA512
586bc4caead0d3e7a2258c968fa374331c624fe5e341278c122daae8517b8e137b34d5e7bb6cbad4298877be8e768960e5ee5a45e627158eef7db67322098e00
-
SSDEEP
1536:CNeAg8r8QvyUt/Ske7Kp3StjEMjmLM3ztDJWZsXy4JzxPMUp+usYZpue/QDZh:HUtqkeJJjmLM3zRJWZsXy4Jdp+Ypue4P
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" huenee.exe -
Executes dropped EXE 1 IoCs
pid Process 1628 huenee.exe -
Loads dropped DLL 2 IoCs
pid Process 1044 1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe 1044 1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ huenee.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\huenee = "C:\\Users\\Admin\\huenee.exe" huenee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe 1628 huenee.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1044 1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe 1628 huenee.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1628 1044 1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe 28 PID 1044 wrote to memory of 1628 1044 1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe 28 PID 1044 wrote to memory of 1628 1044 1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe 28 PID 1044 wrote to memory of 1628 1044 1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe 28 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12 PID 1628 wrote to memory of 1044 1628 huenee.exe 12
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe"C:\Users\Admin\AppData\Local\Temp\1ff1de1692cbb4d0db4f1349ffc0ba5e522448cd0bf585fc5f31b08053b3757f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\huenee.exe"C:\Users\Admin\huenee.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5a7de6914f9531a2177bd7289977300f8
SHA11f3fe1c5bde45d004a7e7ad87e44a5273c415a25
SHA25651b9dde51191434221967f6baeb877aaff535f95bf2ea9f3170f97026b170357
SHA512504fa66605aa35863caf15acd41d615045531329f71ee1e595beb70622e76b22ede5e1e0e421b49832d8660bea9f8b2391369a81a3f9fc8ea66adf1b201b9618
-
Filesize
77KB
MD5a7de6914f9531a2177bd7289977300f8
SHA11f3fe1c5bde45d004a7e7ad87e44a5273c415a25
SHA25651b9dde51191434221967f6baeb877aaff535f95bf2ea9f3170f97026b170357
SHA512504fa66605aa35863caf15acd41d615045531329f71ee1e595beb70622e76b22ede5e1e0e421b49832d8660bea9f8b2391369a81a3f9fc8ea66adf1b201b9618
-
Filesize
77KB
MD5a7de6914f9531a2177bd7289977300f8
SHA11f3fe1c5bde45d004a7e7ad87e44a5273c415a25
SHA25651b9dde51191434221967f6baeb877aaff535f95bf2ea9f3170f97026b170357
SHA512504fa66605aa35863caf15acd41d615045531329f71ee1e595beb70622e76b22ede5e1e0e421b49832d8660bea9f8b2391369a81a3f9fc8ea66adf1b201b9618
-
Filesize
77KB
MD5a7de6914f9531a2177bd7289977300f8
SHA11f3fe1c5bde45d004a7e7ad87e44a5273c415a25
SHA25651b9dde51191434221967f6baeb877aaff535f95bf2ea9f3170f97026b170357
SHA512504fa66605aa35863caf15acd41d615045531329f71ee1e595beb70622e76b22ede5e1e0e421b49832d8660bea9f8b2391369a81a3f9fc8ea66adf1b201b9618