Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19-10-2022 12:57
Static task
static1
Behavioral task
behavioral1
Sample
6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe
-
Size
212KB
-
MD5
a0eab4cd37944721bb7f62ade5358a08
-
SHA1
7622fa7d2f081a0cd9e85c1c921f30b8383664a8
-
SHA256
6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822
-
SHA512
7be177b100f9d9de3e0f9e958e24fe89cb97777fe949ae50989155e0c394d93aab5bf82c2d442766d788579538fa38a8cd703a71b6a9cb6445fc2123b1b2bb4d
-
SSDEEP
6144:2PFFwlPjiAzY09umHh7K5cUXEBwrYVHhAgz6Vcu:YFaxjhY09umH45cUXEBwUVHhAgz6Vx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" viugu.exe -
Executes dropped EXE 1 IoCs
pid Process 2036 viugu.exe -
Loads dropped DLL 2 IoCs
pid Process 1348 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe 1348 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe -
Adds Run key to start application 2 TTPs 58 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /x" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /u" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /z" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /e" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /j" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /d" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /b" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /a" viugu.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /x" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /e" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /d" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /f" 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /k" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /c" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /p" viugu.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /c" viugu.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /m" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /i" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /s" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /t" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /m" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /s" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /g" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /o" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /u" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /b" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /y" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /p" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /f" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /g" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /h" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /f" 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /t" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /v" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /w" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /n" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /n" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /r" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /q" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /o" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /i" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /v" viugu.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /j" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /a" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /z" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /y" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /q" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /l" viugu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /r" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /k" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /f" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /h" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /l" viugu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\viugu = "C:\\Users\\Admin\\viugu.exe /w" viugu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1348 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe 2036 viugu.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2036 viugu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1348 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe 2036 viugu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2036 1348 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe 27 PID 1348 wrote to memory of 2036 1348 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe 27 PID 1348 wrote to memory of 2036 1348 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe 27 PID 1348 wrote to memory of 2036 1348 6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe"C:\Users\Admin\AppData\Local\Temp\6cb712350726cfb4348581f3f53af94528269ee3e302b12d69f99b3d74049822.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\viugu.exe"C:\Users\Admin\viugu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD56275c88d6ff25ecf522f80aed4809c79
SHA1346afb4a9eb09b2ae1653e7fbd194f224854a589
SHA25697e1e2769d58098218349f4ce3f0558bf75a3200efae7dd537d4a96c447c7980
SHA512c6f054fd2356c95ffda969f555707e7560aa1ed9217a71a00bc471dcc8f5e705422dd4910a2e1f233b2273355d0dd4c945e5e01240841b3793733379261ce10b
-
Filesize
212KB
MD56275c88d6ff25ecf522f80aed4809c79
SHA1346afb4a9eb09b2ae1653e7fbd194f224854a589
SHA25697e1e2769d58098218349f4ce3f0558bf75a3200efae7dd537d4a96c447c7980
SHA512c6f054fd2356c95ffda969f555707e7560aa1ed9217a71a00bc471dcc8f5e705422dd4910a2e1f233b2273355d0dd4c945e5e01240841b3793733379261ce10b
-
Filesize
212KB
MD56275c88d6ff25ecf522f80aed4809c79
SHA1346afb4a9eb09b2ae1653e7fbd194f224854a589
SHA25697e1e2769d58098218349f4ce3f0558bf75a3200efae7dd537d4a96c447c7980
SHA512c6f054fd2356c95ffda969f555707e7560aa1ed9217a71a00bc471dcc8f5e705422dd4910a2e1f233b2273355d0dd4c945e5e01240841b3793733379261ce10b
-
Filesize
212KB
MD56275c88d6ff25ecf522f80aed4809c79
SHA1346afb4a9eb09b2ae1653e7fbd194f224854a589
SHA25697e1e2769d58098218349f4ce3f0558bf75a3200efae7dd537d4a96c447c7980
SHA512c6f054fd2356c95ffda969f555707e7560aa1ed9217a71a00bc471dcc8f5e705422dd4910a2e1f233b2273355d0dd4c945e5e01240841b3793733379261ce10b