f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55

General

Target

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
Size

244KB
MD5

4c83f72a0fe7a6a60974368fa7228320
SHA1

20510d503fe7f7036d2771f16b3f43de0bf2b114
SHA256

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55
SHA512

1c2c0c7b308f1a4d730e3668511b3880bef3a3f0bc04a1f080e800d0d07fee7eaec671fd526ce25d5032bb2a63f65d4ccee3350b9ec16cb16fd6b729e01b805a
SSDEEP

6144:QRww39SfGzlTphJgW9mnrQLMjTsZzILK/fObT/bGiuF0a59ONKLUWrIhO1a8p5xV:dw39SfGzlTPJgWUnjjTsZzILK/fObT/A

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exemuuebi.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	muuebi.exe

Executes dropped EXE 1 IoCs

Processes:

muuebi.exe

pid process

872 muuebi.exe

pid	process
872	muuebi.exe

Loads dropped DLL 2 IoCs

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe

pid	process
1364	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
1364	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe

Adds Run key to start application 2 TTPs 48 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exemuuebi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /W"	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /v"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /z"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /f"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /P"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /T"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /j"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /F"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /d"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /i"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /V"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /B"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /N"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /K"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /l"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /H"	muuebi.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /m"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /q"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /M"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /R"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /g"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /Z"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /a"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /I"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /D"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /s"	muuebi.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /Q"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /X"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /Y"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /k"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /t"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /A"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /C"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /x"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /E"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /G"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /b"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /p"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /U"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /S"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /e"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /O"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /w"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /r"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /n"	muuebi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\muuebi = "C:\\Users\\Admin\\muuebi.exe /J"	muuebi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exemuuebi.exe

pid	process
1364	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe
872	muuebi.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exemuuebi.exe

pid process

1364 f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
872 muuebi.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe

description	pid	process	target process
PID 1364 wrote to memory of 872	1364	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe	muuebi.exe
PID 1364 wrote to memory of 872	1364	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe	muuebi.exe
PID 1364 wrote to memory of 872	1364	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe	muuebi.exe
PID 1364 wrote to memory of 872	1364	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe	muuebi.exe

C:\Users\Admin\AppData\Local\Temp\f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
"C:\Users\Admin\AppData\Local\Temp\f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\muuebi.exe
"C:\Users\Admin\muuebi.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\muuebi.exe

Filesize
244KB

MD5
0ccdaef23533fd23f51d1858178c817a

SHA1
a4537166f67cf1d49963ee55ab97aee7cab8f268

SHA256
a4177dc9bf568970ce5677122c950531bfb4c0e4ea6c3b7911d480c02852fb9e

SHA512
aedef5885a201a054429a0547c68bcc527d55dda7c671a7bc6aea7a967d2c743a1c836de9e21ff1b2e7c43fb48a3380ee19316ecb38b2a192cdb143f154aebec

Download Submit
C:\Users\Admin\muuebi.exe

Filesize
244KB

MD5
0ccdaef23533fd23f51d1858178c817a

SHA1
a4537166f67cf1d49963ee55ab97aee7cab8f268

SHA256
a4177dc9bf568970ce5677122c950531bfb4c0e4ea6c3b7911d480c02852fb9e

SHA512
aedef5885a201a054429a0547c68bcc527d55dda7c671a7bc6aea7a967d2c743a1c836de9e21ff1b2e7c43fb48a3380ee19316ecb38b2a192cdb143f154aebec

Download Submit
\Users\Admin\muuebi.exe

Filesize
244KB

MD5
0ccdaef23533fd23f51d1858178c817a

SHA1
a4537166f67cf1d49963ee55ab97aee7cab8f268

SHA256
a4177dc9bf568970ce5677122c950531bfb4c0e4ea6c3b7911d480c02852fb9e

SHA512
aedef5885a201a054429a0547c68bcc527d55dda7c671a7bc6aea7a967d2c743a1c836de9e21ff1b2e7c43fb48a3380ee19316ecb38b2a192cdb143f154aebec

Download Submit
\Users\Admin\muuebi.exe

Filesize
244KB

MD5
0ccdaef23533fd23f51d1858178c817a

SHA1
a4537166f67cf1d49963ee55ab97aee7cab8f268

SHA256
a4177dc9bf568970ce5677122c950531bfb4c0e4ea6c3b7911d480c02852fb9e

SHA512
aedef5885a201a054429a0547c68bcc527d55dda7c671a7bc6aea7a967d2c743a1c836de9e21ff1b2e7c43fb48a3380ee19316ecb38b2a192cdb143f154aebec

Download Submit
memory/872-59-0x0000000000000000-mapping.dmp

Download
memory/1364-56-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads