Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:19
Static task
static1
Behavioral task
behavioral1
Sample
ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
Resource
win10v2004-20220901-en
General
-
Target
ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
-
Size
192KB
-
MD5
1c2b64dcb9286f43bc48ed90fe73a54f
-
SHA1
36301fdb5937a2e418c6c71aa1a33158f502c3e7
-
SHA256
ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803
-
SHA512
956e7d60264c58c667c396aba92a5a0c1b3062e3af492ef5adb1376e5ec311dc947f123134e98b680dd2c5bf317a765e08355e7c999576bde971b833499e4910
-
SSDEEP
3072:KwBJP6h+RH5UL1iUG3KgKLKRKSdNIVqR5VxerayK/fObT/bGicFgvXb6jGJoX:KwBJCcRZSgKgKLKRKSdNIVqRTxEpK/fD
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.execeoumod.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ceoumod.exe -
Executes dropped EXE 1 IoCs
Processes:
ceoumod.exepid process 1152 ceoumod.exe -
Loads dropped DLL 2 IoCs
Processes:
ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exepid process 1464 ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe 1464 ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe -
Adds Run key to start application 2 TTPs 52 IoCs
Processes:
ceoumod.exeee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /v" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /E" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /y" ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /a" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /R" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /i" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /F" ceoumod.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /S" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /k" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /G" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /Y" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /c" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /t" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /q" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /p" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /Q" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /h" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /z" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /r" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /u" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /m" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /A" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /g" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /I" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /C" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /j" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /e" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /B" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /w" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /K" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /H" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /V" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /D" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /s" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /x" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /W" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /Z" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /f" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /d" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /T" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /b" ceoumod.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /l" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /y" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /X" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /N" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /J" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /L" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /M" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /o" ceoumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceoumod = "C:\\Users\\Admin\\ceoumod.exe /O" ceoumod.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.execeoumod.exepid process 1464 ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe 1152 ceoumod.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.execeoumod.exepid process 1464 ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe 1152 ceoumod.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exedescription pid process target process PID 1464 wrote to memory of 1152 1464 ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe ceoumod.exe PID 1464 wrote to memory of 1152 1464 ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe ceoumod.exe PID 1464 wrote to memory of 1152 1464 ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe ceoumod.exe PID 1464 wrote to memory of 1152 1464 ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe ceoumod.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe"C:\Users\Admin\AppData\Local\Temp\ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\ceoumod.exe"C:\Users\Admin\ceoumod.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\ceoumod.exeFilesize
192KB
MD5085c53bdc4a8fecfbf96cc5f56a089dd
SHA191ed2742c6396388bdd9301fab5b360fe8eb9217
SHA25645c33829bb4040c0b85c7013e77f0a341a4397a35044559bb422f585edcc8239
SHA5121f5fe0c661c1167aa5c594584f5be097002ef893726350f2fd0ca727cf1c03083a781e17d1255c6645145d2a336bceebfd23fe75f74c96678ab794c261da4ed9
-
C:\Users\Admin\ceoumod.exeFilesize
192KB
MD5085c53bdc4a8fecfbf96cc5f56a089dd
SHA191ed2742c6396388bdd9301fab5b360fe8eb9217
SHA25645c33829bb4040c0b85c7013e77f0a341a4397a35044559bb422f585edcc8239
SHA5121f5fe0c661c1167aa5c594584f5be097002ef893726350f2fd0ca727cf1c03083a781e17d1255c6645145d2a336bceebfd23fe75f74c96678ab794c261da4ed9
-
\Users\Admin\ceoumod.exeFilesize
192KB
MD5085c53bdc4a8fecfbf96cc5f56a089dd
SHA191ed2742c6396388bdd9301fab5b360fe8eb9217
SHA25645c33829bb4040c0b85c7013e77f0a341a4397a35044559bb422f585edcc8239
SHA5121f5fe0c661c1167aa5c594584f5be097002ef893726350f2fd0ca727cf1c03083a781e17d1255c6645145d2a336bceebfd23fe75f74c96678ab794c261da4ed9
-
\Users\Admin\ceoumod.exeFilesize
192KB
MD5085c53bdc4a8fecfbf96cc5f56a089dd
SHA191ed2742c6396388bdd9301fab5b360fe8eb9217
SHA25645c33829bb4040c0b85c7013e77f0a341a4397a35044559bb422f585edcc8239
SHA5121f5fe0c661c1167aa5c594584f5be097002ef893726350f2fd0ca727cf1c03083a781e17d1255c6645145d2a336bceebfd23fe75f74c96678ab794c261da4ed9
-
memory/1152-59-0x0000000000000000-mapping.dmp
-
memory/1464-56-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB