Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe
-
Size
160KB
-
MD5
013a798498536f0b8321c9711cc84200
-
SHA1
e6e084e89ace5ba49f18006d42e863a2f507f003
-
SHA256
6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99
-
SHA512
4b0ab8a1d8042066bc720b2353315d2de4e3c04ae409f7c0c6c7f3f431cb6433dde2384d79db9d8c1ae6b84ec2caa23b617e20913d10de0e198ac5aefeeca585
-
SSDEEP
3072:JhaxJptfKqOdBsebgeDyJiqmdoTtawZPotUPvPDspYxjatL0JiTeDOokR49M6e3t:naDptfKRLsebgeDyJtmdo7PIWDspYJaB
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pioze.exe -
Executes dropped EXE 1 IoCs
pid Process 944 pioze.exe -
Loads dropped DLL 2 IoCs
pid Process 864 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe 864 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /h" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /Z" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /M" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /J" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /c" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /n" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /t" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /l" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /C" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /x" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /e" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /a" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /N" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /k" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /B" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /K" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /H" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /v" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /V" 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /s" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /q" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /W" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /Q" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /E" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /z" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /F" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /D" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /i" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /V" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /g" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /j" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /Y" pioze.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /y" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /u" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /w" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /P" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /S" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /I" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /X" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /o" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /O" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /L" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /r" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /U" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /A" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /R" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /d" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /G" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /m" pioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pioze = "C:\\Users\\Admin\\pioze.exe /f" pioze.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 864 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe 944 pioze.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 864 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe 944 pioze.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 864 wrote to memory of 944 864 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe 27 PID 864 wrote to memory of 944 864 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe 27 PID 864 wrote to memory of 944 864 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe 27 PID 864 wrote to memory of 944 864 6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe"C:\Users\Admin\AppData\Local\Temp\6f21d52264bd0992a7613178decb214d5a135921640768815d1c567bc847ca99.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\pioze.exe"C:\Users\Admin\pioze.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:944
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD5ddec2d5e4cbbf7ecb5778641f12b107e
SHA150de4998bbee061db2df2e1426c46ee9e628a7ce
SHA256578205bf3d2475dcf06049001f40a12d55732ae33f4ce416257561b8d57c65e2
SHA5129bfbc8e186ea3f5f8fe960d14aededc28175e1066f9727c6caa9d13c044d80b0dde8346abbd361762121002bb39bd9e30a7fa26ea0f5794a8214ee3080698172
-
Filesize
160KB
MD5ddec2d5e4cbbf7ecb5778641f12b107e
SHA150de4998bbee061db2df2e1426c46ee9e628a7ce
SHA256578205bf3d2475dcf06049001f40a12d55732ae33f4ce416257561b8d57c65e2
SHA5129bfbc8e186ea3f5f8fe960d14aededc28175e1066f9727c6caa9d13c044d80b0dde8346abbd361762121002bb39bd9e30a7fa26ea0f5794a8214ee3080698172
-
Filesize
160KB
MD5ddec2d5e4cbbf7ecb5778641f12b107e
SHA150de4998bbee061db2df2e1426c46ee9e628a7ce
SHA256578205bf3d2475dcf06049001f40a12d55732ae33f4ce416257561b8d57c65e2
SHA5129bfbc8e186ea3f5f8fe960d14aededc28175e1066f9727c6caa9d13c044d80b0dde8346abbd361762121002bb39bd9e30a7fa26ea0f5794a8214ee3080698172
-
Filesize
160KB
MD5ddec2d5e4cbbf7ecb5778641f12b107e
SHA150de4998bbee061db2df2e1426c46ee9e628a7ce
SHA256578205bf3d2475dcf06049001f40a12d55732ae33f4ce416257561b8d57c65e2
SHA5129bfbc8e186ea3f5f8fe960d14aededc28175e1066f9727c6caa9d13c044d80b0dde8346abbd361762121002bb39bd9e30a7fa26ea0f5794a8214ee3080698172