Analysis
-
max time kernel
187s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe
-
Size
96KB
-
MD5
93b5247a731e3f826157522f8ded2eaa
-
SHA1
47b4ddb8d77a19b501e76de5d156aad68f1aef50
-
SHA256
262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497
-
SHA512
8ae364821f1fd2c8fa3e652d71e34ed74ec519905a17e22e31cb83e1d064c7d4921b46a14b994702738d6cafee3ad346d5a112dcd2d0d8008c0df07f6cc7d25e
-
SSDEEP
1536:YxfOsOULMD/2BzVBRpIf8ZGuBs0/PFnI8kIi/5p:qf/OrD/2BZS8ZGuHprep
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dupew.exe -
Executes dropped EXE 1 IoCs
pid Process 1480 dupew.exe -
Loads dropped DLL 2 IoCs
pid Process 916 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 916 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /p" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /l" dupew.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /q" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /e" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /a" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /o" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /g" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /k" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /j" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /i" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /y" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /f" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /v" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /x" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /t" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /w" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /d" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /m" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /f" 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /c" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /h" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /r" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /s" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /z" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /n" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /b" dupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dupew = "C:\\Users\\Admin\\dupew.exe /u" dupew.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 916 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe 1480 dupew.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 916 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 1480 dupew.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 916 wrote to memory of 1480 916 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 27 PID 916 wrote to memory of 1480 916 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 27 PID 916 wrote to memory of 1480 916 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 27 PID 916 wrote to memory of 1480 916 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe"C:\Users\Admin\AppData\Local\Temp\262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\dupew.exe"C:\Users\Admin\dupew.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1480
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD57dd84220829cb0e121e7004b6b0a5bdd
SHA1224daf94a36df71099a3e7ddfb778e8b8361796e
SHA256f16e3e36f1fd334598add237336568d69366364edfed57ea9d930cba5f3aba21
SHA5125bd3bd18c01bba03ee5ca0be77ca6b03e01a53aebb6c56db463ce9f6fde339255dcbe1f899fc355f30320a78c31d0e3e65372c8e8438aa0aac850278937d2722
-
Filesize
96KB
MD57dd84220829cb0e121e7004b6b0a5bdd
SHA1224daf94a36df71099a3e7ddfb778e8b8361796e
SHA256f16e3e36f1fd334598add237336568d69366364edfed57ea9d930cba5f3aba21
SHA5125bd3bd18c01bba03ee5ca0be77ca6b03e01a53aebb6c56db463ce9f6fde339255dcbe1f899fc355f30320a78c31d0e3e65372c8e8438aa0aac850278937d2722
-
Filesize
96KB
MD57dd84220829cb0e121e7004b6b0a5bdd
SHA1224daf94a36df71099a3e7ddfb778e8b8361796e
SHA256f16e3e36f1fd334598add237336568d69366364edfed57ea9d930cba5f3aba21
SHA5125bd3bd18c01bba03ee5ca0be77ca6b03e01a53aebb6c56db463ce9f6fde339255dcbe1f899fc355f30320a78c31d0e3e65372c8e8438aa0aac850278937d2722
-
Filesize
96KB
MD57dd84220829cb0e121e7004b6b0a5bdd
SHA1224daf94a36df71099a3e7ddfb778e8b8361796e
SHA256f16e3e36f1fd334598add237336568d69366364edfed57ea9d930cba5f3aba21
SHA5125bd3bd18c01bba03ee5ca0be77ca6b03e01a53aebb6c56db463ce9f6fde339255dcbe1f899fc355f30320a78c31d0e3e65372c8e8438aa0aac850278937d2722