082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295

General

Target

082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe
Size

180KB
MD5

53718f0746a2f794488e2846cde52690
SHA1

929507f75a18040d3d1467f29a2511bce9a4d7f9
SHA256

082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295
SHA512

16ad36f031fa7ed7121d9776ef17a09187be5ef90490183bc357dccc8dd19bc94c87f6c6c242aa2c7dc661a854edd31a6b8b311f009a90742dc9b92db5fc3a69
SSDEEP

3072:KFKmn1MlttMFz8o+F334VSlkfoyHYb/zCHPEhg5JN8x+eDfcAuQPUS9rulhh:KF91MltKaJkHHYb/zCHPEhg5JN8x+eDs

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exezuueyuf.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zuueyuf.exe

Executes dropped EXE 1 IoCs

Processes:

zuueyuf.exe

pid process

4560 zuueyuf.exe

pid	process
4560	zuueyuf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zuueyuf.exe082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /n"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /b"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /M"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /R"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /a"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /K"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /f"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /z"	zuueyuf.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /S"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /j"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /B"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /O"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /u"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /T"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /V"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /c"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /U"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /L"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /Y"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /q"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /C"	zuueyuf.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /Z"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /i"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /A"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /y"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /Q"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /E"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /D"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /d"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /X"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /F"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /o"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /s"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /N"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /r"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /W"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /l"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /J"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /g"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /d"	082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /H"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /w"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /m"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /G"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /t"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /v"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /P"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /e"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /I"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /k"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /h"	zuueyuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuueyuf = "C:\\Users\\Admin\\zuueyuf.exe /x"	zuueyuf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exezuueyuf.exe

pid	process
4916	082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe
4916	082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe
4560	zuueyuf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exezuueyuf.exe

pid process

4916 082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe
4560 zuueyuf.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe

description	pid	process	target process
PID 4916 wrote to memory of 4560	4916	082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe	zuueyuf.exe
PID 4916 wrote to memory of 4560	4916	082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe	zuueyuf.exe
PID 4916 wrote to memory of 4560	4916	082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe	zuueyuf.exe

C:\Users\Admin\AppData\Local\Temp\082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe
"C:\Users\Admin\AppData\Local\Temp\082db0fcf214997990a3d0dc3844439f6d98d165b4548bc5c9c56cf88c67b295.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916

C:\Users\Admin\zuueyuf.exe
"C:\Users\Admin\zuueyuf.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\zuueyuf.exe

Filesize
180KB

MD5
4797426ec5a833580e22f6a8b3256f8a

SHA1
32a4fca9b4d66c495774ac372d63c467e849f3cf

SHA256
bcb51f9d1315ab5c093ef49eb2f73f11ef5b0f195601902b7418a799e6b5bbd8

SHA512
4f4cee0066235783822b1bd896d32b7bd966fa1977b8d3604f2695f6ccae573c28f49d988a5ca711e5e0403b69ecfe971e42b93421affc0cc21792c6b64ef504

Download Submit
C:\Users\Admin\zuueyuf.exe

Filesize
180KB

MD5
4797426ec5a833580e22f6a8b3256f8a

SHA1
32a4fca9b4d66c495774ac372d63c467e849f3cf

SHA256
bcb51f9d1315ab5c093ef49eb2f73f11ef5b0f195601902b7418a799e6b5bbd8

SHA512
4f4cee0066235783822b1bd896d32b7bd966fa1977b8d3604f2695f6ccae573c28f49d988a5ca711e5e0403b69ecfe971e42b93421affc0cc21792c6b64ef504

Download Submit
memory/4560-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads