Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 15:35
Static task
static1
Behavioral task
behavioral1
Sample
00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe
-
Size
44KB
-
MD5
06a084fa131262b3588f383a3b1bf5bf
-
SHA1
bcb3ae8dee56294bca8bf60f02a93050364307df
-
SHA256
00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86
-
SHA512
431224d26ad67af9ad4dda5040f26ab3dd6a68cf04817486e1fdf94f103be4168642e2725da52af20538a0bbf24319b7d5a90bf340e5dfd8bdd33ebc03e9e250
-
SSDEEP
768:z9/HdW9lkO7R9Xe04H7cHPHYmug6UXQm1dIZE2ocOT77eJ:zEPqHyj6S3T77o
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duedue.exe -
Executes dropped EXE 1 IoCs
pid Process 1892 duedue.exe -
Loads dropped DLL 2 IoCs
pid Process 1056 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 1056 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ duedue.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\duedue = "C:\\Users\\Admin\\duedue.exe" duedue.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe 1892 duedue.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1056 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 1892 duedue.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 1892 1056 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 26 PID 1056 wrote to memory of 1892 1056 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 26 PID 1056 wrote to memory of 1892 1056 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 26 PID 1056 wrote to memory of 1892 1056 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 26 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25 PID 1892 wrote to memory of 1056 1892 duedue.exe 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe"C:\Users\Admin\AppData\Local\Temp\00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\duedue.exe"C:\Users\Admin\duedue.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD587d1308829411a111c99aef67016c2d5
SHA1607986f3141a84dbcc2c4cf56bc7b0d8bbb9125d
SHA2568c10ce7aa3995dbba2d6f7e59935ff9def4db63fb74a5ee403d4660dd9df25dd
SHA512de6ece18105a23d63a47cd3d13fde5f71ec1dd6460f481c1cf05bdfd9cc3b9ef2879846ed0c3de5d9912508026e141ff4866b8cf00535e361f29f51fb9f4993d
-
Filesize
44KB
MD587d1308829411a111c99aef67016c2d5
SHA1607986f3141a84dbcc2c4cf56bc7b0d8bbb9125d
SHA2568c10ce7aa3995dbba2d6f7e59935ff9def4db63fb74a5ee403d4660dd9df25dd
SHA512de6ece18105a23d63a47cd3d13fde5f71ec1dd6460f481c1cf05bdfd9cc3b9ef2879846ed0c3de5d9912508026e141ff4866b8cf00535e361f29f51fb9f4993d
-
Filesize
44KB
MD587d1308829411a111c99aef67016c2d5
SHA1607986f3141a84dbcc2c4cf56bc7b0d8bbb9125d
SHA2568c10ce7aa3995dbba2d6f7e59935ff9def4db63fb74a5ee403d4660dd9df25dd
SHA512de6ece18105a23d63a47cd3d13fde5f71ec1dd6460f481c1cf05bdfd9cc3b9ef2879846ed0c3de5d9912508026e141ff4866b8cf00535e361f29f51fb9f4993d
-
Filesize
44KB
MD587d1308829411a111c99aef67016c2d5
SHA1607986f3141a84dbcc2c4cf56bc7b0d8bbb9125d
SHA2568c10ce7aa3995dbba2d6f7e59935ff9def4db63fb74a5ee403d4660dd9df25dd
SHA512de6ece18105a23d63a47cd3d13fde5f71ec1dd6460f481c1cf05bdfd9cc3b9ef2879846ed0c3de5d9912508026e141ff4866b8cf00535e361f29f51fb9f4993d