Analysis
-
max time kernel
172s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 15:25
Static task
static1
Behavioral task
behavioral1
Sample
62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe
Resource
win10v2004-20220812-en
General
-
Target
62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe
-
Size
188KB
-
MD5
091188fd291def1cab1e90c4cfc305f0
-
SHA1
3f63b8d8cde9e38edc1c6de0883110be3897669c
-
SHA256
62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992
-
SHA512
4afd63403cca6b0095f7a34d1810b5f2a5454b8467808f5e2ab6cf4b9c6540d78baf01ef01202e5ada51f52dacc505aa449fd5ad0fec9efec36900d0b6877b80
-
SSDEEP
3072:6j42OHQqQ7b4zxMJsSmJ6nTQFlKRilqoq6v/i:RkqM4zk0cqfMoty
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" soelou.exe -
Executes dropped EXE 1 IoCs
pid Process 1380 soelou.exe -
Loads dropped DLL 2 IoCs
pid Process 1196 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe 1196 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /K" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /P" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /I" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /k" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /G" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /z" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /B" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /V" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /b" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /c" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /f" soelou.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /s" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /j" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /a" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /d" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /q" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /S" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /h" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /Z" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /u" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /N" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /M" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /W" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /X" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /w" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /U" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /n" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /t" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /O" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /g" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /r" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /F" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /l" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /m" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /L" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /y" soelou.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /R" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /C" 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /C" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /D" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /Q" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /Y" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /p" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /A" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /x" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /E" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /v" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /J" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /T" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /H" soelou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\soelou = "C:\\Users\\Admin\\soelou.exe /i" soelou.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1196 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe 1380 soelou.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1196 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe 1380 soelou.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1380 1196 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe 27 PID 1196 wrote to memory of 1380 1196 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe 27 PID 1196 wrote to memory of 1380 1196 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe 27 PID 1196 wrote to memory of 1380 1196 62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe"C:\Users\Admin\AppData\Local\Temp\62bfa3fad284bdcd92ea6d87932a9f827803eaa53034c5decf528fa82ea8f992.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\soelou.exe"C:\Users\Admin\soelou.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1380
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD5784d035356409aeac51e9e09d78c9a7a
SHA124263f449a247da322763e4db37eea50ee8bfd18
SHA256061d5f0347010f28cf94eeaaca87fbc4f07fd2067d6c30ce87ac0f71e8bc5245
SHA51201c3c8be973cc67097e89a0edc9875b786066727f07c6cce0f91044f36d25d4bb73dba80727284d49c87befa2433625aea09a4914042534f279761ec8eb8fda1
-
Filesize
188KB
MD5784d035356409aeac51e9e09d78c9a7a
SHA124263f449a247da322763e4db37eea50ee8bfd18
SHA256061d5f0347010f28cf94eeaaca87fbc4f07fd2067d6c30ce87ac0f71e8bc5245
SHA51201c3c8be973cc67097e89a0edc9875b786066727f07c6cce0f91044f36d25d4bb73dba80727284d49c87befa2433625aea09a4914042534f279761ec8eb8fda1
-
Filesize
188KB
MD5784d035356409aeac51e9e09d78c9a7a
SHA124263f449a247da322763e4db37eea50ee8bfd18
SHA256061d5f0347010f28cf94eeaaca87fbc4f07fd2067d6c30ce87ac0f71e8bc5245
SHA51201c3c8be973cc67097e89a0edc9875b786066727f07c6cce0f91044f36d25d4bb73dba80727284d49c87befa2433625aea09a4914042534f279761ec8eb8fda1
-
Filesize
188KB
MD5784d035356409aeac51e9e09d78c9a7a
SHA124263f449a247da322763e4db37eea50ee8bfd18
SHA256061d5f0347010f28cf94eeaaca87fbc4f07fd2067d6c30ce87ac0f71e8bc5245
SHA51201c3c8be973cc67097e89a0edc9875b786066727f07c6cce0f91044f36d25d4bb73dba80727284d49c87befa2433625aea09a4914042534f279761ec8eb8fda1