Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe
-
Size
220KB
-
MD5
03e99d0c55f82a8099fcc463ed0b4d20
-
SHA1
9b4d6dea9cfb2da85e10d09b5bbf855a503284ef
-
SHA256
f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142
-
SHA512
ea27d3614a4b276897d9bfdcc7115792a927f9bea8c09365d57e85a003010048aedec938f04dc837569a3e8f23b7384b12ce76bba578b9ea44d285940f5d1806
-
SSDEEP
3072:F125rPIa3gisjfGKL+4Rq9GBXPNTClp5GQGvrdSuqTvnKSk3SwTDaWBkNNK:GAKsjfiGBglp5GQGvrdSuqTvnKSkCGk
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ppzuow.exe -
Executes dropped EXE 2 IoCs
pid Process 1380 ppzuow.exe 1232 ppzuow.exe -
Loads dropped DLL 2 IoCs
pid Process 960 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 960 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /t" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /a" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /f" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /b" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /v" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /m" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /n" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /r" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /s" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /y" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /i" ppzuow.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /w" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /z" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /x" ppzuow.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /c" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /g" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /h" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /p" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /j" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /q" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /o" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /t" f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /d" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /e" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /l" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /u" ppzuow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ppzuow = "C:\\Users\\Admin\\ppzuow.exe /k" ppzuow.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ppzuow.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 ppzuow.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\c\autorun.inf ppzuow.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 864 set thread context of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 1380 set thread context of 1232 1380 ppzuow.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 960 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe 1232 ppzuow.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 960 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 1380 ppzuow.exe 1232 ppzuow.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 864 wrote to memory of 960 864 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 27 PID 960 wrote to memory of 1380 960 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 28 PID 960 wrote to memory of 1380 960 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 28 PID 960 wrote to memory of 1380 960 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 28 PID 960 wrote to memory of 1380 960 f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe 28 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29 PID 1380 wrote to memory of 1232 1380 ppzuow.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe"C:\Users\Admin\AppData\Local\Temp\f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142.exe712⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\ppzuow.exe"C:\Users\Admin\ppzuow.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\ppzuow.exe714⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1232
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD503e99d0c55f82a8099fcc463ed0b4d20
SHA19b4d6dea9cfb2da85e10d09b5bbf855a503284ef
SHA256f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142
SHA512ea27d3614a4b276897d9bfdcc7115792a927f9bea8c09365d57e85a003010048aedec938f04dc837569a3e8f23b7384b12ce76bba578b9ea44d285940f5d1806
-
Filesize
220KB
MD503e99d0c55f82a8099fcc463ed0b4d20
SHA19b4d6dea9cfb2da85e10d09b5bbf855a503284ef
SHA256f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142
SHA512ea27d3614a4b276897d9bfdcc7115792a927f9bea8c09365d57e85a003010048aedec938f04dc837569a3e8f23b7384b12ce76bba578b9ea44d285940f5d1806
-
Filesize
220KB
MD503e99d0c55f82a8099fcc463ed0b4d20
SHA19b4d6dea9cfb2da85e10d09b5bbf855a503284ef
SHA256f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142
SHA512ea27d3614a4b276897d9bfdcc7115792a927f9bea8c09365d57e85a003010048aedec938f04dc837569a3e8f23b7384b12ce76bba578b9ea44d285940f5d1806
-
Filesize
220KB
MD503e99d0c55f82a8099fcc463ed0b4d20
SHA19b4d6dea9cfb2da85e10d09b5bbf855a503284ef
SHA256f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142
SHA512ea27d3614a4b276897d9bfdcc7115792a927f9bea8c09365d57e85a003010048aedec938f04dc837569a3e8f23b7384b12ce76bba578b9ea44d285940f5d1806
-
Filesize
220KB
MD503e99d0c55f82a8099fcc463ed0b4d20
SHA19b4d6dea9cfb2da85e10d09b5bbf855a503284ef
SHA256f0ab94fb7002e5a4a79cbd2edf31520040fb049348e0f03b7ba80566734ca142
SHA512ea27d3614a4b276897d9bfdcc7115792a927f9bea8c09365d57e85a003010048aedec938f04dc837569a3e8f23b7384b12ce76bba578b9ea44d285940f5d1806