Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe
-
Size
140KB
-
MD5
07509c7d2211974823aa612437250c00
-
SHA1
5f878bccbc843d7e09f882af3211d72805d67f37
-
SHA256
9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94
-
SHA512
531638def19c841da61b4b5aec3c12f70a92c97b25898d5af886506827e0c240ed8816fc5dd737e49fe314b13390467b4f4e07922a6f3f6c68cbc6a11b87005d
-
SSDEEP
3072:QBgclSAY5uXq0cu3XMO4nZLJY0PoeU60ohKdlLWO3:QBoAY5uXq0cu3XMO4nZLJPot60ohKdlL
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jrfouz.exe -
Executes dropped EXE 1 IoCs
pid Process 1452 jrfouz.exe -
Loads dropped DLL 2 IoCs
pid Process 872 9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe 872 9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /n" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /w" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /S" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /h" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /I" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /D" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /d" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /p" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /T" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /x" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /j" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /s" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /Q" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /r" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /J" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /k" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /t" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /G" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /R" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /y" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /z" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /C" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /l" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /W" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /v" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /L" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /K" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /O" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /i" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /f" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /c" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /E" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /Z" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /U" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /u" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /e" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /B" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /A" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /b" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /M" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /F" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /o" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /P" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /q" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /g" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /V" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /N" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /H" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /m" jrfouz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrfouz = "C:\\Users\\Admin\\jrfouz.exe /Y" jrfouz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe 1452 jrfouz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 872 9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe 1452 jrfouz.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 872 wrote to memory of 1452 872 9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe 28 PID 872 wrote to memory of 1452 872 9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe 28 PID 872 wrote to memory of 1452 872 9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe 28 PID 872 wrote to memory of 1452 872 9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe"C:\Users\Admin\AppData\Local\Temp\9ea307bbec060c25e80edcf94656775ee7d86e28d3cf4660110aef5efb31ab94.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\jrfouz.exe"C:\Users\Admin\jrfouz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1452
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD5736cad4aff34f2eee1e49f41b4153452
SHA136f751e4633e4598363de292ba010518dda927b4
SHA25608ed2c2ba4d3eeadebbb87d74206a4d01763da5cb1dc99193a0c9ba118575e42
SHA512be09b320ba26f74ce959b645debd064f5d2814ccfc9b433d51bca5df4565fe2948cde7ead187ddcb029e140060a7410e474aca281243da6a53cf5c04ea770276
-
Filesize
140KB
MD5736cad4aff34f2eee1e49f41b4153452
SHA136f751e4633e4598363de292ba010518dda927b4
SHA25608ed2c2ba4d3eeadebbb87d74206a4d01763da5cb1dc99193a0c9ba118575e42
SHA512be09b320ba26f74ce959b645debd064f5d2814ccfc9b433d51bca5df4565fe2948cde7ead187ddcb029e140060a7410e474aca281243da6a53cf5c04ea770276
-
Filesize
140KB
MD5736cad4aff34f2eee1e49f41b4153452
SHA136f751e4633e4598363de292ba010518dda927b4
SHA25608ed2c2ba4d3eeadebbb87d74206a4d01763da5cb1dc99193a0c9ba118575e42
SHA512be09b320ba26f74ce959b645debd064f5d2814ccfc9b433d51bca5df4565fe2948cde7ead187ddcb029e140060a7410e474aca281243da6a53cf5c04ea770276
-
Filesize
140KB
MD5736cad4aff34f2eee1e49f41b4153452
SHA136f751e4633e4598363de292ba010518dda927b4
SHA25608ed2c2ba4d3eeadebbb87d74206a4d01763da5cb1dc99193a0c9ba118575e42
SHA512be09b320ba26f74ce959b645debd064f5d2814ccfc9b433d51bca5df4565fe2948cde7ead187ddcb029e140060a7410e474aca281243da6a53cf5c04ea770276