Analysis
-
max time kernel
165s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe
-
Size
260KB
-
MD5
0ed0b1c97ca9cc796891b36ee36b18c9
-
SHA1
92d52e24213e667c435ac6569880a3fd6530c8b4
-
SHA256
2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609
-
SHA512
712188ffb5bd7af026d1f5d2960af5db539d63f3944a103e181a631f6672d60d9d8d2af915aa1131d8cf3bc5b1c57a44aca6294dcc49b467557d6091600d9fd2
-
SSDEEP
3072:vgfAlNLvh25n/kZoSUjMqXnpWAkpAmTSrMaIOYt/jo7LAtPhjjtZnfHFEoWBfGVy:vdSgTSrMaIl/jcLijfHFEHWzXvjT85R
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" weidiq.exe -
Executes dropped EXE 1 IoCs
pid Process 520 weidiq.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /V" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /l" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /Y" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /i" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /K" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /y" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /c" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /u" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /k" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /F" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /H" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /G" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /w" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /t" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /x" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /r" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /T" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /h" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /e" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /L" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /q" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /D" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /N" weidiq.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /A" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /J" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /v" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /s" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /Z" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /n" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /g" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /O" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /z" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /a" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /j" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /E" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /R" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /B" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /C" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /X" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /P" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /Q" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /U" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /W" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /o" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /m" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /M" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /f" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /S" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /I" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /b" weidiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weidiq = "C:\\Users\\Admin\\weidiq.exe /d" weidiq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe 520 weidiq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4416 2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe 520 weidiq.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4416 wrote to memory of 520 4416 2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe 82 PID 4416 wrote to memory of 520 4416 2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe 82 PID 4416 wrote to memory of 520 4416 2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe"C:\Users\Admin\AppData\Local\Temp\2c81cf7e7dac0610ca081184820de65e41b63df503cd2b24db20b4a87da57609.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\weidiq.exe"C:\Users\Admin\weidiq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:520
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD507e52793eecab142aceddf64aae4c4fa
SHA1e963f7190fe7498ac19ebf9c99f9412d7cf64d80
SHA256269039257ccfb8794197429052394a963e0342426b3ca7a655f8f56cf4ee7c7e
SHA51229b9a26db9282ed39d1e687a794e0b93773e93b7533afc34c664eb6d2fb698c2970a1c0bdd0ea8077ce2fcf8535b8972d6acf6f75c92ff55eb2e4d0a8116adef
-
Filesize
260KB
MD507e52793eecab142aceddf64aae4c4fa
SHA1e963f7190fe7498ac19ebf9c99f9412d7cf64d80
SHA256269039257ccfb8794197429052394a963e0342426b3ca7a655f8f56cf4ee7c7e
SHA51229b9a26db9282ed39d1e687a794e0b93773e93b7533afc34c664eb6d2fb698c2970a1c0bdd0ea8077ce2fcf8535b8972d6acf6f75c92ff55eb2e4d0a8116adef