Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe
-
Size
100KB
-
MD5
a130d5d5bbb74718bf148e7aef3a2f04
-
SHA1
572de3ba5e821b0223e1e5d9aeba15d6ffbff0ae
-
SHA256
36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4
-
SHA512
ec1a58d6ecae2d7ba94dbde67e6d4b76c878165bee98840602ecb1d615da8623cefd3810b4c6813ed3ba6cb97e706ba318d5a6c81ec74692dca23e392aa71215
-
SSDEEP
1536:HWb8iAuismyWsoRw0wF9MGM9K/lKtNgCMbATbL3N+NM5EfKNIjni:aotTLOM5hCni
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" weicuz.exe -
Executes dropped EXE 1 IoCs
pid Process 1580 weicuz.exe -
Loads dropped DLL 2 IoCs
pid Process 1416 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe 1416 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /M" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /u" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /w" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /l" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /A" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /i" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /s" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /t" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /J" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /k" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /q" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /G" weicuz.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /N" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /f" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /W" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /O" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /S" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /R" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /d" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /Z" weicuz.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /H" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /U" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /X" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /c" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /m" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /L" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /n" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /r" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /g" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /o" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /j" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /y" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /C" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /e" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /p" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /T" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /b" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /F" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /V" 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /B" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /Q" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /a" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /P" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /I" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /z" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /D" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /h" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /K" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /Y" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /E" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /x" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /v" weicuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\weicuz = "C:\\Users\\Admin\\weicuz.exe /V" weicuz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1416 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe 1580 weicuz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1416 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe 1580 weicuz.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1416 wrote to memory of 1580 1416 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe 26 PID 1416 wrote to memory of 1580 1416 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe 26 PID 1416 wrote to memory of 1580 1416 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe 26 PID 1416 wrote to memory of 1580 1416 36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe"C:\Users\Admin\AppData\Local\Temp\36f8ed362a60fdef8d2f7695c53fa88b75d624c53f5da358cca2b710375daaf4.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\weicuz.exe"C:\Users\Admin\weicuz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5af981051fdabae8fda8c31471296c150
SHA11b838e9e9d707e5e56af8b1193e65633848e95fc
SHA2567fbd561703635324be551b5cad30327735a9c8eae24d3887ab1e6227c8492d2b
SHA512011d3a8211c6d0bed3f1dad419ca26df7343fc961daf588c12b98f3b006cd7f3b4c389d885c6f2e3146df72ce6617cbee0c9c750c140ada8c3f7a954ef828225
-
Filesize
100KB
MD5af981051fdabae8fda8c31471296c150
SHA11b838e9e9d707e5e56af8b1193e65633848e95fc
SHA2567fbd561703635324be551b5cad30327735a9c8eae24d3887ab1e6227c8492d2b
SHA512011d3a8211c6d0bed3f1dad419ca26df7343fc961daf588c12b98f3b006cd7f3b4c389d885c6f2e3146df72ce6617cbee0c9c750c140ada8c3f7a954ef828225
-
Filesize
100KB
MD5af981051fdabae8fda8c31471296c150
SHA11b838e9e9d707e5e56af8b1193e65633848e95fc
SHA2567fbd561703635324be551b5cad30327735a9c8eae24d3887ab1e6227c8492d2b
SHA512011d3a8211c6d0bed3f1dad419ca26df7343fc961daf588c12b98f3b006cd7f3b4c389d885c6f2e3146df72ce6617cbee0c9c750c140ada8c3f7a954ef828225
-
Filesize
100KB
MD5af981051fdabae8fda8c31471296c150
SHA11b838e9e9d707e5e56af8b1193e65633848e95fc
SHA2567fbd561703635324be551b5cad30327735a9c8eae24d3887ab1e6227c8492d2b
SHA512011d3a8211c6d0bed3f1dad419ca26df7343fc961daf588c12b98f3b006cd7f3b4c389d885c6f2e3146df72ce6617cbee0c9c750c140ada8c3f7a954ef828225