Analysis
-
max time kernel
153s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 18:01
Static task
static1
Behavioral task
behavioral1
Sample
0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe
-
Size
60KB
-
MD5
0d8019c17d6bcbccfa182ca35d0bfa1d
-
SHA1
8b506e22812d9bea90a1df63b354742aa24ef5a6
-
SHA256
0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c
-
SHA512
b1a6a6436b03591f86cf48b5fb804f5a891d383ede37f715abb37527ee428dce5fb92b032d727eca1955729a70b85df462b3d848d15dfbaa314963c18e2fa1a5
-
SSDEEP
768:wXkmpnBc/vupnsyRg6+9A/v/bVlbdfs3OfKDHGIHY56Wv:wXkEpn7u6y43wY56Wv
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" homep.exe -
Executes dropped EXE 1 IoCs
pid Process 912 homep.exe -
Loads dropped DLL 2 IoCs
pid Process 288 0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe 288 0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ homep.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\homep = "C:\\Users\\Admin\\homep.exe" homep.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe 912 homep.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 288 0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe 912 homep.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 288 wrote to memory of 912 288 0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe 26 PID 288 wrote to memory of 912 288 0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe 26 PID 288 wrote to memory of 912 288 0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe 26 PID 288 wrote to memory of 912 288 0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe 26 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25 PID 912 wrote to memory of 288 912 homep.exe 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe"C:\Users\Admin\AppData\Local\Temp\0cb9e42daa989203750a7ad20b55ebde7950ddccf04e806c5111ce7b7ccabd9c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Users\Admin\homep.exe"C:\Users\Admin\homep.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD53e08f8f180ab3a564207c3aa4f2f6e9e
SHA13f62e1c39082bab85a27ee9215386b1c6adf5579
SHA256dbea1b83fe3b1b0aa87d06e8afa6eee2da2103fa7aeedae644e6de8bf6f84cb8
SHA5125fb96c23557050d39869092e991f38a0250d0ccfcf4652ee8cf6d6e8a265602dc30900b6b83d07c84ae38b421165e75a226f5ac01588eabd9fa7eb400342505c
-
Filesize
60KB
MD53e08f8f180ab3a564207c3aa4f2f6e9e
SHA13f62e1c39082bab85a27ee9215386b1c6adf5579
SHA256dbea1b83fe3b1b0aa87d06e8afa6eee2da2103fa7aeedae644e6de8bf6f84cb8
SHA5125fb96c23557050d39869092e991f38a0250d0ccfcf4652ee8cf6d6e8a265602dc30900b6b83d07c84ae38b421165e75a226f5ac01588eabd9fa7eb400342505c
-
Filesize
60KB
MD53e08f8f180ab3a564207c3aa4f2f6e9e
SHA13f62e1c39082bab85a27ee9215386b1c6adf5579
SHA256dbea1b83fe3b1b0aa87d06e8afa6eee2da2103fa7aeedae644e6de8bf6f84cb8
SHA5125fb96c23557050d39869092e991f38a0250d0ccfcf4652ee8cf6d6e8a265602dc30900b6b83d07c84ae38b421165e75a226f5ac01588eabd9fa7eb400342505c
-
Filesize
60KB
MD53e08f8f180ab3a564207c3aa4f2f6e9e
SHA13f62e1c39082bab85a27ee9215386b1c6adf5579
SHA256dbea1b83fe3b1b0aa87d06e8afa6eee2da2103fa7aeedae644e6de8bf6f84cb8
SHA5125fb96c23557050d39869092e991f38a0250d0ccfcf4652ee8cf6d6e8a265602dc30900b6b83d07c84ae38b421165e75a226f5ac01588eabd9fa7eb400342505c