Analysis
-
max time kernel
151s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 16:01
Static task
static1
Behavioral task
behavioral1
Sample
4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe
-
Size
200KB
-
MD5
44fd9959c9fe943c78ca068f8a9ef02a
-
SHA1
6a211091a046f0720cff7ed15f78386c272ebccd
-
SHA256
4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488
-
SHA512
e93d30d735f64e2feac128303950105a9a750c7b1cd3ff45510bb03d07c347a51ddbe33e74bb7fb117771a3541a1e0c0d52dd5c660504a5133d940cf47a10e61
-
SSDEEP
3072:7U0VB80tQ9nLHbB9WHCS0AgTlhsp3mWEPl:R84QxL7B9WHK9Jhsp3a9
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ciaifoz.exe -
Executes dropped EXE 1 IoCs
pid Process 1436 ciaifoz.exe -
Loads dropped DLL 2 IoCs
pid Process 1076 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe 1076 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe -
Adds Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /b" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /s" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /i" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /a" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /t" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /l" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /g" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /x" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /a" 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /v" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /j" ciaifoz.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /d" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /u" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /p" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /n" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /z" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /q" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /k" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /c" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /w" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /h" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /o" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /m" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /f" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /e" ciaifoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciaifoz = "C:\\Users\\Admin\\ciaifoz.exe /y" ciaifoz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1076 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe 1436 ciaifoz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1076 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe 1436 ciaifoz.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1436 1076 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe 27 PID 1076 wrote to memory of 1436 1076 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe 27 PID 1076 wrote to memory of 1436 1076 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe 27 PID 1076 wrote to memory of 1436 1076 4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe"C:\Users\Admin\AppData\Local\Temp\4f3b8f23fbb5fe5c3c07cad096e3769da03d4d60899ee1c2a9cb3d6cff83a488.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\ciaifoz.exe"C:\Users\Admin\ciaifoz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1436
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD556c6d0618c8a7392d7c6e5cec9cecee0
SHA19d495e47cb9cbbc5f05cbdfd232cac090fc77145
SHA2561e407c029dae93324b56638ad629430f1728dcf65caa7dbad2b29837bcbf4a69
SHA5123989b63ed5625e9df5e1511d46ff2f6c83f32a1bb7c40bc03467c9b03a637517731337c0ae5570fce2016e35c69ce912478a2c1dc0cabc305928e5137c33450d
-
Filesize
200KB
MD556c6d0618c8a7392d7c6e5cec9cecee0
SHA19d495e47cb9cbbc5f05cbdfd232cac090fc77145
SHA2561e407c029dae93324b56638ad629430f1728dcf65caa7dbad2b29837bcbf4a69
SHA5123989b63ed5625e9df5e1511d46ff2f6c83f32a1bb7c40bc03467c9b03a637517731337c0ae5570fce2016e35c69ce912478a2c1dc0cabc305928e5137c33450d
-
Filesize
200KB
MD556c6d0618c8a7392d7c6e5cec9cecee0
SHA19d495e47cb9cbbc5f05cbdfd232cac090fc77145
SHA2561e407c029dae93324b56638ad629430f1728dcf65caa7dbad2b29837bcbf4a69
SHA5123989b63ed5625e9df5e1511d46ff2f6c83f32a1bb7c40bc03467c9b03a637517731337c0ae5570fce2016e35c69ce912478a2c1dc0cabc305928e5137c33450d
-
Filesize
200KB
MD556c6d0618c8a7392d7c6e5cec9cecee0
SHA19d495e47cb9cbbc5f05cbdfd232cac090fc77145
SHA2561e407c029dae93324b56638ad629430f1728dcf65caa7dbad2b29837bcbf4a69
SHA5123989b63ed5625e9df5e1511d46ff2f6c83f32a1bb7c40bc03467c9b03a637517731337c0ae5570fce2016e35c69ce912478a2c1dc0cabc305928e5137c33450d