Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-10-2022 22:20
Static task
static1
Behavioral task
behavioral1
Sample
de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe
-
Size
120KB
-
MD5
06d57367caf54da00ded3938bbec87ab
-
SHA1
19e9d411b0142c72ba235dd7b33ba5245b704843
-
SHA256
de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942
-
SHA512
820cfaf50249b2d3a22a3f3a4508deb464117dd7825bbcc5edaed7bd1f6403ddb98e4366ef228c38ec29983c5c3a62c4c75edd2e6f8aab361815968b6d8fd030
-
SSDEEP
1536:tGGocZXUZ10EmoiHl7gRNq27ddDhJmRjfFp6jhQh8bA0zb69ZeqpZj2jMhuysesw:tGK6HmvFKnAjfFQLA0zbPq36jRNEH
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bsliuj.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe -
Executes dropped EXE 1 IoCs
pid Process 1160 bsliuj.exe -
Loads dropped DLL 2 IoCs
pid Process 1424 de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe 1424 de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /J" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /z" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /q" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /B" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /F" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /S" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /M" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /W" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /N" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /b" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /l" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /t" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /K" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /w" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /I" bsliuj.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /v" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /j" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /A" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /x" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /e" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /u" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /L" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /o" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /y" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /d" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /X" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /g" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /Q" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /n" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /i" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /I" de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /c" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /Y" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /Z" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /C" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /r" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /R" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /H" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /U" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /f" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /k" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /E" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /O" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /m" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /G" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /s" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /a" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /T" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /D" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /P" bsliuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bsliuj = "C:\\Users\\Admin\\bsliuj.exe /p" bsliuj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1424 de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe 1160 bsliuj.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1424 de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe 1160 bsliuj.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1424 wrote to memory of 1160 1424 de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe 26 PID 1424 wrote to memory of 1160 1424 de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe 26 PID 1424 wrote to memory of 1160 1424 de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe 26 PID 1424 wrote to memory of 1160 1424 de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe"C:\Users\Admin\AppData\Local\Temp\de5bb136e2c6dafc5de85b7b51a0524647385c8abec9c0cd6790a7684cc05942.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\bsliuj.exe"C:\Users\Admin\bsliuj.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1160
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD5c8521734ef6b351b220d2262d74fd4f3
SHA16cb402631902ca17ba0e508eebca60254b4ad6fd
SHA2563ef5fb9dd6329277feaf0afae5b167784cfbd4c258c0fad908367f8024c5ecae
SHA5121ba5f59b1e4a2dba1d50e3bbda40358996a61be0b6bf92330c84a6a6de7d6508a6580072614e369e6f45c837d0f4f6b3b966018670fe0a7794876f66c3374a5c
-
Filesize
120KB
MD5c8521734ef6b351b220d2262d74fd4f3
SHA16cb402631902ca17ba0e508eebca60254b4ad6fd
SHA2563ef5fb9dd6329277feaf0afae5b167784cfbd4c258c0fad908367f8024c5ecae
SHA5121ba5f59b1e4a2dba1d50e3bbda40358996a61be0b6bf92330c84a6a6de7d6508a6580072614e369e6f45c837d0f4f6b3b966018670fe0a7794876f66c3374a5c
-
Filesize
120KB
MD5c8521734ef6b351b220d2262d74fd4f3
SHA16cb402631902ca17ba0e508eebca60254b4ad6fd
SHA2563ef5fb9dd6329277feaf0afae5b167784cfbd4c258c0fad908367f8024c5ecae
SHA5121ba5f59b1e4a2dba1d50e3bbda40358996a61be0b6bf92330c84a6a6de7d6508a6580072614e369e6f45c837d0f4f6b3b966018670fe0a7794876f66c3374a5c
-
Filesize
120KB
MD5c8521734ef6b351b220d2262d74fd4f3
SHA16cb402631902ca17ba0e508eebca60254b4ad6fd
SHA2563ef5fb9dd6329277feaf0afae5b167784cfbd4c258c0fad908367f8024c5ecae
SHA5121ba5f59b1e4a2dba1d50e3bbda40358996a61be0b6bf92330c84a6a6de7d6508a6580072614e369e6f45c837d0f4f6b3b966018670fe0a7794876f66c3374a5c