Analysis
-
max time kernel
153s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 19:08
Static task
static1
Behavioral task
behavioral1
Sample
4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe
-
Size
244KB
-
MD5
4402bf86a46318fa24277a8802de18cc
-
SHA1
2dd2d2e3bbdd2427b34cfcfafda08668b6f421d6
-
SHA256
4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770
-
SHA512
9dc5037b5d09b4db82a73b9d03a1af731126e55a173fc7707aa2fcd675fe7c896f066b3ffbfec66fbd87cd231c9e3f66d7928ae3b35eba573817f96cca62cf92
-
SSDEEP
6144:Y/w8DFe0qip4r1XNOmNBLxAG7H59R7g0fY4rGK/fObT/bGijVq1Wzr/+mNGXnFGi:Y48DFe0qip4rZNOm3FAG7H59R7g0fY4f
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" saapue.exe -
Executes dropped EXE 1 IoCs
pid Process 2576 saapue.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /y" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /F" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /x" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /D" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /v" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /E" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /b" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /T" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /A" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /N" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /J" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /u" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /g" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /a" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /Q" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /H" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /i" 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /Y" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /m" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /G" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /X" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /l" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /W" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /h" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /r" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /L" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /p" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /e" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /t" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /M" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /q" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /z" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /c" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /C" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /n" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /O" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /K" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /P" saapue.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /V" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /B" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /d" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /k" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /o" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /U" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /S" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /w" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /f" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /s" saapue.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /j" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /i" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /Z" saapue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saapue = "C:\\Users\\Admin\\saapue.exe /I" saapue.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4924 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe 4924 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe 2576 saapue.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4924 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe 2576 saapue.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4924 wrote to memory of 2576 4924 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe 84 PID 4924 wrote to memory of 2576 4924 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe 84 PID 4924 wrote to memory of 2576 4924 4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe"C:\Users\Admin\AppData\Local\Temp\4d128c0cd7a06088c923bd3d004f0ff06a853fc467200dcc961ef218f3eca770.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\saapue.exe"C:\Users\Admin\saapue.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2576
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD592515c98a209aa4e5b0a91c5d3f28ff2
SHA11cd86efbb8193c795f66e5496ef3d6c3e85c4413
SHA25638fd4ac84a794a5b77abec986ff8132429ad2bd6cbc95c34c6ada4e4e5c1fde0
SHA512b8dd6784dc00a946aaa905057aa9b9a4355fa1a727365cf330ef36cf857e2ccd2fe675922334d9d639be73199c2986fbc405cfd923d6c0eb6aeda88516356265
-
Filesize
244KB
MD592515c98a209aa4e5b0a91c5d3f28ff2
SHA11cd86efbb8193c795f66e5496ef3d6c3e85c4413
SHA25638fd4ac84a794a5b77abec986ff8132429ad2bd6cbc95c34c6ada4e4e5c1fde0
SHA512b8dd6784dc00a946aaa905057aa9b9a4355fa1a727365cf330ef36cf857e2ccd2fe675922334d9d639be73199c2986fbc405cfd923d6c0eb6aeda88516356265