Analysis
-
max time kernel
150s -
max time network
86s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:08
Static task
static1
Behavioral task
behavioral1
Sample
8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe
Resource
win10v2004-20220812-en
General
-
Target
8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe
-
Size
248KB
-
MD5
25efd5741079fc0f785406b863745733
-
SHA1
dc614bec7d891327e849639f9accf1ed06ec9794
-
SHA256
8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd
-
SHA512
c4867717f046568b149c05d6f12845013c9a01fc8ad17a50a0a6c20ef3d16fb2460b9816da08682c4ff128885b5d0bd26b29cfd583089121e2c2b9e7bdbaedd2
-
SSDEEP
3072:54clvBhDo0BKxWVeBYhInpMFgYykBgfXzRRpGPlOH+cZknPh43Ucl:Wcl3dgEeqPFXTgfV6PlOH+gKPu3x
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.execiamue.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ciamue.exe -
Executes dropped EXE 1 IoCs
Processes:
ciamue.exepid process 956 ciamue.exe -
Loads dropped DLL 2 IoCs
Processes:
8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exepid process 1632 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe 1632 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe -
Adds Run key to start application 2 TTPs 53 IoCs
Processes:
ciamue.exe8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /H" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /o" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /t" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /P" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /p" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /h" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /j" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /X" ciamue.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /R" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /r" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /l" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /N" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /w" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /V" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /c" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /m" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /S" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /i" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /K" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /O" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /E" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /g" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /G" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /F" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /f" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /d" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /x" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /k" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /B" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /q" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /C" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /W" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /Z" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /y" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /D" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /T" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /a" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /u" ciamue.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /q" 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /Y" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /I" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /b" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /Q" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /n" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /e" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /U" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /L" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /v" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /z" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /J" ciamue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciamue = "C:\\Users\\Admin\\ciamue.exe /M" ciamue.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.execiamue.exepid process 1632 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe 956 ciamue.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.execiamue.exepid process 1632 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe 956 ciamue.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exedescription pid process target process PID 1632 wrote to memory of 956 1632 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe ciamue.exe PID 1632 wrote to memory of 956 1632 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe ciamue.exe PID 1632 wrote to memory of 956 1632 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe ciamue.exe PID 1632 wrote to memory of 956 1632 8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe ciamue.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe"C:\Users\Admin\AppData\Local\Temp\8d0ebdc5d2c6904503406660e51fb3abb9098f7ff764a30d3d5e3046271aa3dd.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\ciamue.exe"C:\Users\Admin\ciamue.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\ciamue.exeFilesize
248KB
MD54688184ae722359059adbfe047169c5a
SHA1758765bcb9f5839f401ac9b711478baab56eb063
SHA25648b50212439739b3be71695bc12ac09d9242e2de2d9d8709d8f4d04449a015bf
SHA512af1d05e90dc7bddc514d4c3b8cc849628a0dc64c5788afd1a2c8b69c83a88219d2ce2d599ee2c6d45bcd09c62c1813584b95414a36c7b056fe66e590e679dd1e
-
C:\Users\Admin\ciamue.exeFilesize
248KB
MD54688184ae722359059adbfe047169c5a
SHA1758765bcb9f5839f401ac9b711478baab56eb063
SHA25648b50212439739b3be71695bc12ac09d9242e2de2d9d8709d8f4d04449a015bf
SHA512af1d05e90dc7bddc514d4c3b8cc849628a0dc64c5788afd1a2c8b69c83a88219d2ce2d599ee2c6d45bcd09c62c1813584b95414a36c7b056fe66e590e679dd1e
-
\Users\Admin\ciamue.exeFilesize
248KB
MD54688184ae722359059adbfe047169c5a
SHA1758765bcb9f5839f401ac9b711478baab56eb063
SHA25648b50212439739b3be71695bc12ac09d9242e2de2d9d8709d8f4d04449a015bf
SHA512af1d05e90dc7bddc514d4c3b8cc849628a0dc64c5788afd1a2c8b69c83a88219d2ce2d599ee2c6d45bcd09c62c1813584b95414a36c7b056fe66e590e679dd1e
-
\Users\Admin\ciamue.exeFilesize
248KB
MD54688184ae722359059adbfe047169c5a
SHA1758765bcb9f5839f401ac9b711478baab56eb063
SHA25648b50212439739b3be71695bc12ac09d9242e2de2d9d8709d8f4d04449a015bf
SHA512af1d05e90dc7bddc514d4c3b8cc849628a0dc64c5788afd1a2c8b69c83a88219d2ce2d599ee2c6d45bcd09c62c1813584b95414a36c7b056fe66e590e679dd1e
-
memory/956-59-0x0000000000000000-mapping.dmp
-
memory/1632-56-0x0000000076091000-0x0000000076093000-memory.dmpFilesize
8KB