Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe
-
Size
116KB
-
MD5
54368c907f0cf494f91f2478490dc6e0
-
SHA1
ca436cb2a30d3c61ed7b7653c7506dce4933b068
-
SHA256
bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55
-
SHA512
861eaa565a5dbd643640ef0f1882d44ca9aa34a32d923d62f30cfb26a6200f142d0fdda4b8ae4f573fbc7ad8a1307b1b076905313df42d9025edb581091d09f9
-
SSDEEP
1536:qUsNo7v2V46QhdrSXt+XazoFm+D+w+j+4+1kbiMUer7n9sqAEFO7F2Mlb:Vlb
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meari.exe -
Executes dropped EXE 1 IoCs
pid Process 1276 meari.exe -
Loads dropped DLL 2 IoCs
pid Process 1600 bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe 1600 bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /P" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /h" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /s" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /O" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /q" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /b" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /k" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /t" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /l" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /E" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /N" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /o" meari.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /n" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /w" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /p" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /y" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /m" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /V" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /x" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /F" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /Y" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /M" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /v" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /J" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /f" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /d" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /u" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /T" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /c" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /r" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /K" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /Q" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /X" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /L" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /S" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /G" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /H" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /I" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /D" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /g" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /A" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /z" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /e" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /j" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /W" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /C" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /U" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /R" meari.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\meari = "C:\\Users\\Admin\\meari.exe /a" meari.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe 1276 meari.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1600 bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe 1276 meari.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1276 1600 bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe 27 PID 1600 wrote to memory of 1276 1600 bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe 27 PID 1600 wrote to memory of 1276 1600 bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe 27 PID 1600 wrote to memory of 1276 1600 bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe 27 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26 PID 1276 wrote to memory of 1600 1276 meari.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe"C:\Users\Admin\AppData\Local\Temp\bebac0ab8aeebbfc64a0c2d0644b99f1c7f720bff4219c59343f74b689ce2d55.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\meari.exe"C:\Users\Admin\meari.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5c8902ab1862ccb3e4aec9f0c1bf3ed91
SHA18f428d2a05e3556b025e5741e5989f72950821f5
SHA256e47d85bf06c622c1912e19fe734b52e1406f35a5ee910b3b02f4107fc1d741e3
SHA512d7bd2550d8ee466da28fb9911af9dddf72bd1ac5b8d93b25f409dbc05da05e76531b17aaef527c1d878ef8c1c3bcad18f1c21a771a19daa50fabee3db4803d56
-
Filesize
116KB
MD5c8902ab1862ccb3e4aec9f0c1bf3ed91
SHA18f428d2a05e3556b025e5741e5989f72950821f5
SHA256e47d85bf06c622c1912e19fe734b52e1406f35a5ee910b3b02f4107fc1d741e3
SHA512d7bd2550d8ee466da28fb9911af9dddf72bd1ac5b8d93b25f409dbc05da05e76531b17aaef527c1d878ef8c1c3bcad18f1c21a771a19daa50fabee3db4803d56
-
Filesize
116KB
MD5c8902ab1862ccb3e4aec9f0c1bf3ed91
SHA18f428d2a05e3556b025e5741e5989f72950821f5
SHA256e47d85bf06c622c1912e19fe734b52e1406f35a5ee910b3b02f4107fc1d741e3
SHA512d7bd2550d8ee466da28fb9911af9dddf72bd1ac5b8d93b25f409dbc05da05e76531b17aaef527c1d878ef8c1c3bcad18f1c21a771a19daa50fabee3db4803d56
-
Filesize
116KB
MD5c8902ab1862ccb3e4aec9f0c1bf3ed91
SHA18f428d2a05e3556b025e5741e5989f72950821f5
SHA256e47d85bf06c622c1912e19fe734b52e1406f35a5ee910b3b02f4107fc1d741e3
SHA512d7bd2550d8ee466da28fb9911af9dddf72bd1ac5b8d93b25f409dbc05da05e76531b17aaef527c1d878ef8c1c3bcad18f1c21a771a19daa50fabee3db4803d56