Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2022 15:35
Static task
static1
Behavioral task
behavioral1
Sample
00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe
-
Size
44KB
-
MD5
06a084fa131262b3588f383a3b1bf5bf
-
SHA1
bcb3ae8dee56294bca8bf60f02a93050364307df
-
SHA256
00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86
-
SHA512
431224d26ad67af9ad4dda5040f26ab3dd6a68cf04817486e1fdf94f103be4168642e2725da52af20538a0bbf24319b7d5a90bf340e5dfd8bdd33ebc03e9e250
-
SSDEEP
768:z9/HdW9lkO7R9Xe04H7cHPHYmug6UXQm1dIZE2ocOT77eJ:zEPqHyj6S3T77o
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" riuom.exe -
Executes dropped EXE 1 IoCs
pid Process 2168 riuom.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ riuom.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuom = "C:\\Users\\Admin\\riuom.exe" riuom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe 2168 riuom.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4836 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 2168 riuom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 2168 4836 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 81 PID 4836 wrote to memory of 2168 4836 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 81 PID 4836 wrote to memory of 2168 4836 00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe 81 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80 PID 2168 wrote to memory of 4836 2168 riuom.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe"C:\Users\Admin\AppData\Local\Temp\00ff75bbab48f79e24d82df7dca2e6dc4a27881a4d2066bb48b252df646eba86.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\riuom.exe"C:\Users\Admin\riuom.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD587eb02e938c3f6ee071d87739e570023
SHA1e951e769af5d13f48628c139766abea05ac9b764
SHA256e4878a6d168e13b1749ba5f334c13a19f39bf986ccbfbebcf784723b75372d10
SHA5120ec564704c2464431da58b8ea7423e8f5d955db653b374e767c1db329ae494929b9781f2cefd744b20af5109f55ef82ce001f35095fd51978b9c259a10556502
-
Filesize
44KB
MD587eb02e938c3f6ee071d87739e570023
SHA1e951e769af5d13f48628c139766abea05ac9b764
SHA256e4878a6d168e13b1749ba5f334c13a19f39bf986ccbfbebcf784723b75372d10
SHA5120ec564704c2464431da58b8ea7423e8f5d955db653b374e767c1db329ae494929b9781f2cefd744b20af5109f55ef82ce001f35095fd51978b9c259a10556502