Analysis
-
max time kernel
153s -
max time network
60s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 00:55
Static task
static1
Behavioral task
behavioral1
Sample
350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe
-
Size
116KB
-
MD5
0dcdb3a977340994498a536502b4bb50
-
SHA1
c89bcd4f4e7b68bf87a5bdedc93a733bf07ff394
-
SHA256
350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044
-
SHA512
590aa020a45e03a1de4896fbdc1729139acfffc567efd26f79a3d88364f2fe3aa70bfa89dda06e4f50f1a44b5a5a00ead86f214bf250f5ec84300e660fa9c04d
-
SSDEEP
1536:ZPB3h6XVQkT/3fs8koyFFx57Yj3oJoFDuhQHy4ktWq:RJQlQavfMLEj3oJoAhayWq
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" buuozur.exe -
Executes dropped EXE 1 IoCs
pid Process 1960 buuozur.exe -
Loads dropped DLL 2 IoCs
pid Process 2020 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe 2020 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /y" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /p" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /n" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /h" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /f" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /o" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /s" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /z" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /c" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /j" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /x" buuozur.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /v" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /q" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /t" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /r" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /w" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /g" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /k" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /d" buuozur.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /l" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /m" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /b" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /a" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /u" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /g" 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /i" buuozur.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\buuozur = "C:\\Users\\Admin\\buuozur.exe /e" buuozur.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2020 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe 1960 buuozur.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2020 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe 1960 buuozur.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1960 2020 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe 26 PID 2020 wrote to memory of 1960 2020 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe 26 PID 2020 wrote to memory of 1960 2020 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe 26 PID 2020 wrote to memory of 1960 2020 350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe"C:\Users\Admin\AppData\Local\Temp\350a9675632afa1f5cc1e3020bdc14b80be45211dfeb22d8f5c1dd02938f6044.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\buuozur.exe"C:\Users\Admin\buuozur.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1960
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD50502786ed995c0ea21c0514763559a1e
SHA139ebc345ca89b1003dfb471a066d1c1773613f90
SHA2564ade83f9b8057a3700ea2fbf05b043c5e1d49bb5ff7f734283f77f4765b0f1ec
SHA5126763e849ad343c5562e548c04c8b765f14ddb660b51b24e13a26190a246abda8128de4dc56276e86ea0bf7af02dc0d0f287a34db1defa164b76004e4961dead6
-
Filesize
116KB
MD50502786ed995c0ea21c0514763559a1e
SHA139ebc345ca89b1003dfb471a066d1c1773613f90
SHA2564ade83f9b8057a3700ea2fbf05b043c5e1d49bb5ff7f734283f77f4765b0f1ec
SHA5126763e849ad343c5562e548c04c8b765f14ddb660b51b24e13a26190a246abda8128de4dc56276e86ea0bf7af02dc0d0f287a34db1defa164b76004e4961dead6
-
Filesize
116KB
MD50502786ed995c0ea21c0514763559a1e
SHA139ebc345ca89b1003dfb471a066d1c1773613f90
SHA2564ade83f9b8057a3700ea2fbf05b043c5e1d49bb5ff7f734283f77f4765b0f1ec
SHA5126763e849ad343c5562e548c04c8b765f14ddb660b51b24e13a26190a246abda8128de4dc56276e86ea0bf7af02dc0d0f287a34db1defa164b76004e4961dead6
-
Filesize
116KB
MD50502786ed995c0ea21c0514763559a1e
SHA139ebc345ca89b1003dfb471a066d1c1773613f90
SHA2564ade83f9b8057a3700ea2fbf05b043c5e1d49bb5ff7f734283f77f4765b0f1ec
SHA5126763e849ad343c5562e548c04c8b765f14ddb660b51b24e13a26190a246abda8128de4dc56276e86ea0bf7af02dc0d0f287a34db1defa164b76004e4961dead6