a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7

General

Target

a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe
Size

232KB
MD5

43fe0ce228af0cd94c860aac6329a700
SHA1

d526fb075fb0e1258afdc74486199d5706af93ad
SHA256

a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7
SHA512

24203efc0e558cdcdbdf4dc14e69fc3fac42c4dd37a474fadbd6924a6568fd93fbf00c8b7627017115d6c68b94e7fd1b4eb08b06ed406d70f9fb4142339f71e1
SSDEEP

3072:bD64wfWRrIMNRlZ62Pal2LBJXmzOHm5WZ3K+MCEFqTcWEyxeL2mDHLz/5L5DEr6s:H6zepp3PJXCOGY3eNFRFyMdL5DEr6Ul

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exeguikuad.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	guikuad.exe

Executes dropped EXE 1 IoCs

Processes:

guikuad.exe

pid process

1372 guikuad.exe

pid	process
1372	guikuad.exe

Loads dropped DLL 2 IoCs

Processes:

a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe

pid	process
1428	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe
1428	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

guikuad.exea2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /b"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /q"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /z"	guikuad.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /s"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /x"	guikuad.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /r"	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /l"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /o"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /w"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /i"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /p"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /e"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /h"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /n"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /c"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /k"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /r"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /d"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /j"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /g"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /u"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /f"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /t"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /v"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /y"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /m"	guikuad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guikuad = "C:\\Users\\Admin\\guikuad.exe /a"	guikuad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exeguikuad.exe

pid	process
1428	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe
1372	guikuad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exeguikuad.exe

pid process

1428 a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe
1372 guikuad.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe

description	pid	process	target process
PID 1428 wrote to memory of 1372	1428	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe	guikuad.exe
PID 1428 wrote to memory of 1372	1428	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe	guikuad.exe
PID 1428 wrote to memory of 1372	1428	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe	guikuad.exe
PID 1428 wrote to memory of 1372	1428	a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe	guikuad.exe

C:\Users\Admin\AppData\Local\Temp\a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe
"C:\Users\Admin\AppData\Local\Temp\a2c18d449aaf2c0ee899af7402169129b14a5c0fc5f36cd84566a0f3f19797d7.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\guikuad.exe
"C:\Users\Admin\guikuad.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\guikuad.exe

Filesize
232KB

MD5
a06a6c5ef424aa60dd54d4b8c06da2f6

SHA1
0769551bf2efccec129bccd9827e97d8739203f2

SHA256
32ee9cc0c96de8e922761ca616f046ea9bfff176634a87713453966c9f8eae97

SHA512
3f0fa5864ba14946c77bf203624e78dbf1c698fe65196dbcba2bf3ce5c232c8d156becff563d96b4e88ee23043ecee3250694f2ac5c5fb7b7f1754c17cc77532

Download Submit
C:\Users\Admin\guikuad.exe

Filesize
232KB

MD5
a06a6c5ef424aa60dd54d4b8c06da2f6

SHA1
0769551bf2efccec129bccd9827e97d8739203f2

SHA256
32ee9cc0c96de8e922761ca616f046ea9bfff176634a87713453966c9f8eae97

SHA512
3f0fa5864ba14946c77bf203624e78dbf1c698fe65196dbcba2bf3ce5c232c8d156becff563d96b4e88ee23043ecee3250694f2ac5c5fb7b7f1754c17cc77532

Download Submit
\Users\Admin\guikuad.exe

Filesize
232KB

MD5
a06a6c5ef424aa60dd54d4b8c06da2f6

SHA1
0769551bf2efccec129bccd9827e97d8739203f2

SHA256
32ee9cc0c96de8e922761ca616f046ea9bfff176634a87713453966c9f8eae97

SHA512
3f0fa5864ba14946c77bf203624e78dbf1c698fe65196dbcba2bf3ce5c232c8d156becff563d96b4e88ee23043ecee3250694f2ac5c5fb7b7f1754c17cc77532

Download Submit
\Users\Admin\guikuad.exe

Filesize
232KB

MD5
a06a6c5ef424aa60dd54d4b8c06da2f6

SHA1
0769551bf2efccec129bccd9827e97d8739203f2

SHA256
32ee9cc0c96de8e922761ca616f046ea9bfff176634a87713453966c9f8eae97

SHA512
3f0fa5864ba14946c77bf203624e78dbf1c698fe65196dbcba2bf3ce5c232c8d156becff563d96b4e88ee23043ecee3250694f2ac5c5fb7b7f1754c17cc77532

Download Submit
memory/1372-59-0x0000000000000000-mapping.dmp

Download
memory/1428-56-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads