Analysis
-
max time kernel
152s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe
-
Size
260KB
-
MD5
0e89b140c3393615a3fc815f290f8b1b
-
SHA1
1998e24ee4b1f4d028653c1494ca90417e2ff2f3
-
SHA256
8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac
-
SHA512
0bb8d744492e763cc3baff0c93256f8fe65530797c9caf32411ea93b9a282f1f83774473ad975921f1df8faca559b067d1c0d55273962dbc0b44db6d23c97d28
-
SSDEEP
3072:6gfAlNGvh25n/kZoSUjMqXnpWAkpAmTSrMaIOYt/jo7LAtPhjjtZnfHFEoWBfGVa:6dLgTSrMaIl/jcLijfHFEHWzXvjT85R
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" riupon.exe -
Executes dropped EXE 1 IoCs
pid Process 1076 riupon.exe -
Loads dropped DLL 2 IoCs
pid Process 1932 8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe 1932 8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /Z" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /z" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /R" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /q" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /O" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /o" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /r" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /e" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /k" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /L" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /N" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /C" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /u" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /l" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /H" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /A" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /g" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /s" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /h" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /v" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /X" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /f" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /j" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /t" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /x" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /F" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /J" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /M" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /y" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /c" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /S" riupon.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /Y" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /V" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /K" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /W" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /p" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /n" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /w" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /P" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /b" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /G" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /m" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /T" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /B" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /i" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /d" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /I" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /U" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /a" riupon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\riupon = "C:\\Users\\Admin\\riupon.exe /D" riupon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe 1076 riupon.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1932 8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe 1076 riupon.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 1076 1932 8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe 28 PID 1932 wrote to memory of 1076 1932 8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe 28 PID 1932 wrote to memory of 1076 1932 8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe 28 PID 1932 wrote to memory of 1076 1932 8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe"C:\Users\Admin\AppData\Local\Temp\8f482dac0944cb3e893f071256f648d19978ade4bdbe3adfa59e4860810234ac.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\riupon.exe"C:\Users\Admin\riupon.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1076
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD5a93c4e4b9e84c0a8016aca2a2e9deef4
SHA1774aba1b6d92e852b19fa7943a868a39dbff7558
SHA256627183c44b017ab22598f65d17fe931b10980e3e5774d0f732c01a47f85534c2
SHA5128a4a545cfe2308157413da08449e900d8cc2b5d524bcc6ce9ab25287faea0e74ed9ad2bb29b06feaf501cec81d33c63930934a1b00bd5f33a5a59bf8c0c95404
-
Filesize
260KB
MD5a93c4e4b9e84c0a8016aca2a2e9deef4
SHA1774aba1b6d92e852b19fa7943a868a39dbff7558
SHA256627183c44b017ab22598f65d17fe931b10980e3e5774d0f732c01a47f85534c2
SHA5128a4a545cfe2308157413da08449e900d8cc2b5d524bcc6ce9ab25287faea0e74ed9ad2bb29b06feaf501cec81d33c63930934a1b00bd5f33a5a59bf8c0c95404
-
Filesize
260KB
MD5a93c4e4b9e84c0a8016aca2a2e9deef4
SHA1774aba1b6d92e852b19fa7943a868a39dbff7558
SHA256627183c44b017ab22598f65d17fe931b10980e3e5774d0f732c01a47f85534c2
SHA5128a4a545cfe2308157413da08449e900d8cc2b5d524bcc6ce9ab25287faea0e74ed9ad2bb29b06feaf501cec81d33c63930934a1b00bd5f33a5a59bf8c0c95404
-
Filesize
260KB
MD5a93c4e4b9e84c0a8016aca2a2e9deef4
SHA1774aba1b6d92e852b19fa7943a868a39dbff7558
SHA256627183c44b017ab22598f65d17fe931b10980e3e5774d0f732c01a47f85534c2
SHA5128a4a545cfe2308157413da08449e900d8cc2b5d524bcc6ce9ab25287faea0e74ed9ad2bb29b06feaf501cec81d33c63930934a1b00bd5f33a5a59bf8c0c95404