Analysis
-
max time kernel
168s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 22:43
Static task
static1
Behavioral task
behavioral1
Sample
f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe
-
Size
224KB
-
MD5
414af8e7b880bef1fe8851211a452220
-
SHA1
70e6be6a2726e9229488c5350cc1f8409cd56395
-
SHA256
f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848
-
SHA512
b456603b67b495a10e69249e1e0e12f21ce9f41cef9fbf5ad62627daafab3f98a11011645bd88484d16e42e7464cce3435c0818443f38ea65ee40a89e47b7a77
-
SSDEEP
3072:Z5IIRIsIqrgl4iEzjKTF40qVA0KNBx9lDy:Z5IoxIqrgCHpXA0KZ9w
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" geuodor.exe -
Executes dropped EXE 1 IoCs
pid Process 3804 geuodor.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /O" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /F" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /w" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /p" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /A" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /y" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /t" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /a" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /q" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /x" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /K" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /b" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /g" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /Z" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /z" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /N" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /Y" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /d" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /H" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /k" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /R" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /Q" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /M" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /h" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /U" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /X" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /W" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /f" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /u" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /E" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /B" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /j" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /V" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /c" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /I" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /D" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /s" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /J" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /i" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /S" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /v" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /e" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /H" f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /o" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /P" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /r" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /T" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /l" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /n" geuodor.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /G" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /L" geuodor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geuodor = "C:\\Users\\Admin\\geuodor.exe /C" geuodor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1420 f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe 1420 f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe 3804 geuodor.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1420 f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe 3804 geuodor.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1420 wrote to memory of 3804 1420 f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe 84 PID 1420 wrote to memory of 3804 1420 f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe 84 PID 1420 wrote to memory of 3804 1420 f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe"C:\Users\Admin\AppData\Local\Temp\f3651967349968672fb16a02d8a07fcf1320235d720f581d2aab6d09514b5848.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\geuodor.exe"C:\Users\Admin\geuodor.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3804
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5ea26b411cf1aca64326105f3dcd2d762
SHA1441eb8378ab8d33a1e3bd2c5407312e50a0da076
SHA256978d42fa9493564a811d24996f45e26f675e2fc4d18d7f9afc11374bf5c67d3b
SHA5123014956d7f58d20720e9fb5d5c6bfe4cc97e0c39ebda7043b9b0b02794d7335cd3dac3a10af5bae4ca21e77e4364f08187733f834539fa28d114675bf49ea225
-
Filesize
224KB
MD5ea26b411cf1aca64326105f3dcd2d762
SHA1441eb8378ab8d33a1e3bd2c5407312e50a0da076
SHA256978d42fa9493564a811d24996f45e26f675e2fc4d18d7f9afc11374bf5c67d3b
SHA5123014956d7f58d20720e9fb5d5c6bfe4cc97e0c39ebda7043b9b0b02794d7335cd3dac3a10af5bae4ca21e77e4364f08187733f834539fa28d114675bf49ea225