14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a

General

Target

14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe
Size

156KB
MD5

50e759d1453f57f7557fc6201f6c49d9
SHA1

e6a4ecf4b0d7748cdfd957e282a80911317fbf01
SHA256

14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a
SHA512

6dcc44051996c3e66318f45255c7ee7f642b8e10f3ff8e93158598590b69d727cca043234bafecd73a55d1605b28f6d26815bc4114835a53a5272b7378af0939
SSDEEP

1536:PYkumDuYBcBU8gRDGHPOGMmUbaxGAka+t/K9rCGaV9mw7Jqx8M+dzAb5QgRV8:fDuYBqa4UbaxqkCGaVD7JqfKAb6o8

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exevaoseim.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vaoseim.exe

Executes dropped EXE 1 IoCs

Processes:

vaoseim.exe

pid process

1956 vaoseim.exe

pid	process
1956	vaoseim.exe

Loads dropped DLL 2 IoCs

Processes:

14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe

pid	process
536	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe
536	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vaoseim.exe14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /p"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /c"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /e"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /k"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /j"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /E"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /L"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /V"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /u"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /H"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /o"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /y"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /n"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /h"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /C"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /O"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /w"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /S"	vaoseim.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /U"	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /U"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /G"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /Q"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /B"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /N"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /F"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /Z"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /i"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /J"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /Y"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /A"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /a"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /D"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /z"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /X"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /f"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /R"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /T"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /s"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /x"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /b"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /K"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /I"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /g"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /d"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /P"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /t"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /q"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /v"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /r"	vaoseim.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /M"	vaoseim.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaoseim = "C:\\Users\\Admin\\vaoseim.exe /l"	vaoseim.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exevaoseim.exe

pid	process
536	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe
1956	vaoseim.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exevaoseim.exe

pid process

536 14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe
1956 vaoseim.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe

description	pid	process	target process
PID 536 wrote to memory of 1956	536	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe	vaoseim.exe
PID 536 wrote to memory of 1956	536	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe	vaoseim.exe
PID 536 wrote to memory of 1956	536	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe	vaoseim.exe
PID 536 wrote to memory of 1956	536	14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe	vaoseim.exe

C:\Users\Admin\AppData\Local\Temp\14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe
"C:\Users\Admin\AppData\Local\Temp\14bc6da689091f28365d7da8f34539907e984b653df5418d2f8bad5ac8b6389a.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\vaoseim.exe
"C:\Users\Admin\vaoseim.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\vaoseim.exe

Filesize
156KB

MD5
7552fa6b2bdc08dcc477667042d0c765

SHA1
84894d2eff3498c7f82ade6cdfa1e6e6e68e77c5

SHA256
4c40b900980ee53110d77b47e4e5dff4602e35d4b486bbdda5f4bb2178371d69

SHA512
d0114ba914575703f22891c3a2f70ab1e7c9ee7857eb2c63d3d32a1a5e88f0afd51c05810986a7ff4459a28acf75333d5da510d2416d60d3c73cca88261ba9e5

Download Submit
C:\Users\Admin\vaoseim.exe

Filesize
156KB

MD5
7552fa6b2bdc08dcc477667042d0c765

SHA1
84894d2eff3498c7f82ade6cdfa1e6e6e68e77c5

SHA256
4c40b900980ee53110d77b47e4e5dff4602e35d4b486bbdda5f4bb2178371d69

SHA512
d0114ba914575703f22891c3a2f70ab1e7c9ee7857eb2c63d3d32a1a5e88f0afd51c05810986a7ff4459a28acf75333d5da510d2416d60d3c73cca88261ba9e5

Download Submit
\Users\Admin\vaoseim.exe

Filesize
156KB

MD5
7552fa6b2bdc08dcc477667042d0c765

SHA1
84894d2eff3498c7f82ade6cdfa1e6e6e68e77c5

SHA256
4c40b900980ee53110d77b47e4e5dff4602e35d4b486bbdda5f4bb2178371d69

SHA512
d0114ba914575703f22891c3a2f70ab1e7c9ee7857eb2c63d3d32a1a5e88f0afd51c05810986a7ff4459a28acf75333d5da510d2416d60d3c73cca88261ba9e5

Download Submit
\Users\Admin\vaoseim.exe

Filesize
156KB

MD5
7552fa6b2bdc08dcc477667042d0c765

SHA1
84894d2eff3498c7f82ade6cdfa1e6e6e68e77c5

SHA256
4c40b900980ee53110d77b47e4e5dff4602e35d4b486bbdda5f4bb2178371d69

SHA512
d0114ba914575703f22891c3a2f70ab1e7c9ee7857eb2c63d3d32a1a5e88f0afd51c05810986a7ff4459a28acf75333d5da510d2416d60d3c73cca88261ba9e5

Download Submit
memory/536-56-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1956-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads