f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55

General

Target

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
Size

244KB
MD5

4c83f72a0fe7a6a60974368fa7228320
SHA1

20510d503fe7f7036d2771f16b3f43de0bf2b114
SHA256

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55
SHA512

1c2c0c7b308f1a4d730e3668511b3880bef3a3f0bc04a1f080e800d0d07fee7eaec671fd526ce25d5032bb2a63f65d4ccee3350b9ec16cb16fd6b729e01b805a
SSDEEP

6144:QRww39SfGzlTphJgW9mnrQLMjTsZzILK/fObT/bGiuF0a59ONKLUWrIhO1a8p5xV:dw39SfGzlTPJgWUnjjTsZzILK/fObT/A

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exebaeozaj.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	baeozaj.exe

Executes dropped EXE 1 IoCs

Processes:

baeozaj.exe

pid process

4104 baeozaj.exe

pid	process
4104	baeozaj.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

baeozaj.exef1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /V"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /U"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /w"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /Y"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /b"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /i"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /v"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /W"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /F"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /m"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /r"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /S"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /q"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /G"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /K"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /O"	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /u"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /k"	baeozaj.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /y"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /a"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /B"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /f"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /l"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /g"	baeozaj.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run\	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /I"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /P"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /e"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /Q"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /R"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /C"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /s"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /t"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /z"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /A"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /M"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /c"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /E"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /o"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /Z"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /O"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /j"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /h"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /X"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /x"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /L"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /D"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /N"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /T"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /H"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /p"	baeozaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baeozaj = "C:\\Users\\Admin\\baeozaj.exe /d"	baeozaj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exebaeozaj.exe

pid	process
4728	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
4728	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe
4104	baeozaj.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exebaeozaj.exe

pid process

4728 f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
4104 baeozaj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe

description	pid	process	target process
PID 4728 wrote to memory of 4104	4728	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe	baeozaj.exe
PID 4728 wrote to memory of 4104	4728	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe	baeozaj.exe
PID 4728 wrote to memory of 4104	4728	f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe	baeozaj.exe

C:\Users\Admin\AppData\Local\Temp\f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe
"C:\Users\Admin\AppData\Local\Temp\f1934501ff3804c7200db4a2fc3972b49a3e5792f79803265a971eb667289b55.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728

C:\Users\Admin\baeozaj.exe
"C:\Users\Admin\baeozaj.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\baeozaj.exe

Filesize
244KB

MD5
6f2b72604a801c3b5218fb49ad81f48b

SHA1
a1f42b4059558fddc53a8bae2aa13e70e0871fa9

SHA256
3639e0b869f2c3fe29186de9be6c35f919afeb360b9ef6c1c9ce3e459a997e3f

SHA512
a68148a3813564dd0f97fbd4703cef08b6e46e82dfdc394de61ab014f15833b8c2ed3549460f94aeae36f40dbeb99b0c0a7cace4004b1b4d2074c526d7a168bd

Download Submit
C:\Users\Admin\baeozaj.exe

Filesize
244KB

MD5
6f2b72604a801c3b5218fb49ad81f48b

SHA1
a1f42b4059558fddc53a8bae2aa13e70e0871fa9

SHA256
3639e0b869f2c3fe29186de9be6c35f919afeb360b9ef6c1c9ce3e459a997e3f

SHA512
a68148a3813564dd0f97fbd4703cef08b6e46e82dfdc394de61ab014f15833b8c2ed3549460f94aeae36f40dbeb99b0c0a7cace4004b1b4d2074c526d7a168bd

Download Submit
memory/4104-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads