Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe
-
Size
84KB
-
MD5
9396f5d3bf6c52d523425b09bb0d8670
-
SHA1
2e7ecfafd4559b7a55957f43a4b6802296367d4b
-
SHA256
b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b
-
SHA512
1985440ab5ba4b16c46ed0033a98ebda8284b9fea3db666765ce68eda055743f3b2de6806d188723014231ff3e7784699a02d5c090d9a93303da154b5738737c
-
SSDEEP
768:s9Whb6K4Fd6eUCRGIIPP1y7oLacaIBLP3nEZCcLX/CVSFJ0T72Uap5/7TON+7:shTFTUCxQ1a1ocTzFJ0T72VpF7
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yiuyiuv.exe -
Executes dropped EXE 1 IoCs
pid Process 892 yiuyiuv.exe -
Loads dropped DLL 2 IoCs
pid Process 1976 b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe 1976 b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /r" b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /d" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /v" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /m" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /q" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /c" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /h" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /g" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /x" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /i" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /k" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /a" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /b" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /t" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /r" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /p" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /z" yiuyiuv.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /s" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /n" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /l" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /o" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /y" yiuyiuv.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /e" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /u" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /j" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /w" yiuyiuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiuyiuv = "C:\\Users\\Admin\\yiuyiuv.exe /f" yiuyiuv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1976 b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe 892 yiuyiuv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1976 b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe 892 yiuyiuv.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 892 1976 b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe 26 PID 1976 wrote to memory of 892 1976 b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe 26 PID 1976 wrote to memory of 892 1976 b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe 26 PID 1976 wrote to memory of 892 1976 b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe"C:\Users\Admin\AppData\Local\Temp\b637eedc366522320a2ed97ec8a84bb0b314db257faa1c83581d756e0c7ef78b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\yiuyiuv.exe"C:\Users\Admin\yiuyiuv.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:892
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5b14c17ab015c26a1e9b95ebb84fbc4c9
SHA1a13ea2bd185c77844228e9cbe8a87481793ed9eb
SHA256cba18130a20b618c634907ad038951d50b19a0589ac58ccdb07cfa01e80aea38
SHA51222e093efe547e3afaf100ff28d3280b2bf5ed07781e4d3e2e842bf918ef2b0ee70be4425ed02991793a9879f00ed1b5dc2f38a872a7378b8185f501549581d10
-
Filesize
84KB
MD5b14c17ab015c26a1e9b95ebb84fbc4c9
SHA1a13ea2bd185c77844228e9cbe8a87481793ed9eb
SHA256cba18130a20b618c634907ad038951d50b19a0589ac58ccdb07cfa01e80aea38
SHA51222e093efe547e3afaf100ff28d3280b2bf5ed07781e4d3e2e842bf918ef2b0ee70be4425ed02991793a9879f00ed1b5dc2f38a872a7378b8185f501549581d10
-
Filesize
84KB
MD5b14c17ab015c26a1e9b95ebb84fbc4c9
SHA1a13ea2bd185c77844228e9cbe8a87481793ed9eb
SHA256cba18130a20b618c634907ad038951d50b19a0589ac58ccdb07cfa01e80aea38
SHA51222e093efe547e3afaf100ff28d3280b2bf5ed07781e4d3e2e842bf918ef2b0ee70be4425ed02991793a9879f00ed1b5dc2f38a872a7378b8185f501549581d10
-
Filesize
84KB
MD5b14c17ab015c26a1e9b95ebb84fbc4c9
SHA1a13ea2bd185c77844228e9cbe8a87481793ed9eb
SHA256cba18130a20b618c634907ad038951d50b19a0589ac58ccdb07cfa01e80aea38
SHA51222e093efe547e3afaf100ff28d3280b2bf5ed07781e4d3e2e842bf918ef2b0ee70be4425ed02991793a9879f00ed1b5dc2f38a872a7378b8185f501549581d10