b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361

General

Target

b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe
Size

128KB
MD5

5ff1dfa3e99499031ce8b416633c8cc0
SHA1

c5788fa88c87094e2eb2dbc58308a35da89967e5
SHA256

b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361
SHA512

4bf288184df11390f5b06ec922c3ecf2b23f17fd8854a720c87d1cb15eebb6edfbcc729b3bdcc678b8dbb4e199cd75a6b9a0219b7a60a2b50493e3f0b9f515a2
SSDEEP

1536:idusiAhgIuFQFvHwd6PXOYb7gXWgWKsEHTINeG0h/E:Susiqg/FQByYb7gvsEzM

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exepooiket.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	pooiket.exe

Executes dropped EXE 1 IoCs

Processes:

pooiket.exe

pid process

1404 pooiket.exe

pid	process
1404	pooiket.exe

Loads dropped DLL 2 IoCs

Processes:

b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe

pid	process
1712	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe
1712	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pooiket.exeb19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /B"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /c"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /q"	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /r"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /L"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /h"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /Y"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /J"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /y"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /g"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /j"	pooiket.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /q"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /E"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /d"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /b"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /M"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /A"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /p"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /T"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /G"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /u"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /f"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /D"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /Z"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /O"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /a"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /x"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /I"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /S"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /n"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /l"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /v"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /C"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /s"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /o"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /K"	pooiket.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /Q"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /N"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /e"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /W"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /t"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /k"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /U"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /F"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /w"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /z"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /X"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /i"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /R"	pooiket.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pooiket = "C:\\Users\\Admin\\pooiket.exe /V"	pooiket.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exepooiket.exe

pid	process
1712	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe
1404	pooiket.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exepooiket.exe

pid process

1712 b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe
1404 pooiket.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe

description	pid	process	target process
PID 1712 wrote to memory of 1404	1712	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe	pooiket.exe
PID 1712 wrote to memory of 1404	1712	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe	pooiket.exe
PID 1712 wrote to memory of 1404	1712	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe	pooiket.exe
PID 1712 wrote to memory of 1404	1712	b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe	pooiket.exe

C:\Users\Admin\AppData\Local\Temp\b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe
"C:\Users\Admin\AppData\Local\Temp\b19d49901abd80afa963c45e08cc6f34cb28c715fd9082256474c93d2bff4361.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\pooiket.exe
"C:\Users\Admin\pooiket.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\pooiket.exe

Filesize
128KB

MD5
b7aa49af2d675c20359083983842f0fb

SHA1
86ae220ad38fecb636eb2acc08e040eccf8a9a29

SHA256
79ace97b2bda05e1da2524428f278c7504dd892862d7bdcb35850ab28c4f5b09

SHA512
b430bb7e87932ce8dc50191d1257878a793f23135232aa0424c79c60d6e2b4ec9ef22e7fc2bf27f3802017927941588016b0e1fa3e4226812c801ca9186bb12b

Download Submit
C:\Users\Admin\pooiket.exe

Filesize
128KB

MD5
b7aa49af2d675c20359083983842f0fb

SHA1
86ae220ad38fecb636eb2acc08e040eccf8a9a29

SHA256
79ace97b2bda05e1da2524428f278c7504dd892862d7bdcb35850ab28c4f5b09

SHA512
b430bb7e87932ce8dc50191d1257878a793f23135232aa0424c79c60d6e2b4ec9ef22e7fc2bf27f3802017927941588016b0e1fa3e4226812c801ca9186bb12b

Download Submit
\Users\Admin\pooiket.exe

Filesize
128KB

MD5
b7aa49af2d675c20359083983842f0fb

SHA1
86ae220ad38fecb636eb2acc08e040eccf8a9a29

SHA256
79ace97b2bda05e1da2524428f278c7504dd892862d7bdcb35850ab28c4f5b09

SHA512
b430bb7e87932ce8dc50191d1257878a793f23135232aa0424c79c60d6e2b4ec9ef22e7fc2bf27f3802017927941588016b0e1fa3e4226812c801ca9186bb12b

Download Submit
\Users\Admin\pooiket.exe

Filesize
128KB

MD5
b7aa49af2d675c20359083983842f0fb

SHA1
86ae220ad38fecb636eb2acc08e040eccf8a9a29

SHA256
79ace97b2bda05e1da2524428f278c7504dd892862d7bdcb35850ab28c4f5b09

SHA512
b430bb7e87932ce8dc50191d1257878a793f23135232aa0424c79c60d6e2b4ec9ef22e7fc2bf27f3802017927941588016b0e1fa3e4226812c801ca9186bb12b

Download Submit
memory/1404-60-0x0000000000000000-mapping.dmp

Download
memory/1404-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1404-71-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1712-57-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1712-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1712-65-0x0000000002FA0000-0x0000000002FC8000-memory.dmp

Filesize
160KB

Download
memory/1712-66-0x0000000002FA0000-0x0000000002FC8000-memory.dmp

Filesize
160KB

Download
memory/1712-69-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1712-70-0x0000000002FA0000-0x0000000002FC8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads