c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5

General

Target

c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe
Size

192KB
MD5

38013ff72b427e321d57176bb1e5fe93
SHA1

2534a72508e17bdf7b7cd6efe498d8884b3a7acf
SHA256

c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5
SHA512

06cf3afe44559faf43a21459b223371621247b1fd1f9849fd46719590d14056d702a2614569a32d692b23c2d2f5b65e4d969a31854b5a52ebf9641edeeedd69b
SSDEEP

3072:RJfGDmFROnFyF7QR8HR9TrRd7tJDicW34oaVnr5JUJpFWYWWIS:RJfz7QR8HpdzW34oaVnNiJpFrW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

woepae.exec8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	woepae.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe

Executes dropped EXE 1 IoCs

Processes:

woepae.exe

pid process

1748 woepae.exe

pid	process
1748	woepae.exe

Loads dropped DLL 2 IoCs

Processes:

c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe

pid	process
1732	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe
1732	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

woepae.exec8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /e"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /r"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /L"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /l"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /V"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /s"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /x"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /q"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /S"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /Y"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /G"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /z"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /g"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /j"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /v"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /i"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /c"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /A"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /n"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /R"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /N"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /y"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /X"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /W"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /O"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /H"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /K"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /T"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /b"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /I"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /w"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /J"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /Z"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /z"	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /p"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /m"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /D"	woepae.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /u"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /B"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /F"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /a"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /o"	woepae.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /f"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /Q"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /t"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /P"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /h"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /C"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /d"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /M"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /U"	woepae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\woepae = "C:\\Users\\Admin\\woepae.exe /k"	woepae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exewoepae.exe

pid	process
1732	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe
1748	woepae.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exewoepae.exe

pid process

1732 c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe
1748 woepae.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe

description	pid	process	target process
PID 1732 wrote to memory of 1748	1732	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe	woepae.exe
PID 1732 wrote to memory of 1748	1732	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe	woepae.exe
PID 1732 wrote to memory of 1748	1732	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe	woepae.exe
PID 1732 wrote to memory of 1748	1732	c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe	woepae.exe

C:\Users\Admin\AppData\Local\Temp\c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe
"C:\Users\Admin\AppData\Local\Temp\c8cf32c757654b12b745bdc08fd008a0e4a512ecc2ac8c5f35cb8cb370e1e2d5.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\woepae.exe
"C:\Users\Admin\woepae.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\woepae.exe
Filesize
192KB

MD5
1d6707762ce5239aa26f2a0e0d0cf78b

SHA1
5fb529442ccf6353d2fdbd2c929915002631485b

SHA256
3924e867f6397c66e61f96d090e9bd246c0f9c0a8ae23113590b3b7fa412fb41

SHA512
ba46e149a32b82a3076d4d518bc8da3460ece50da5a01c46845354119499539862ec2b6d9a7fcd13e3e5c7e8e4b604592c615658315bcd627a931534a9089dcd

Download Submit
C:\Users\Admin\woepae.exe
Filesize
192KB

MD5
1d6707762ce5239aa26f2a0e0d0cf78b

SHA1
5fb529442ccf6353d2fdbd2c929915002631485b

SHA256
3924e867f6397c66e61f96d090e9bd246c0f9c0a8ae23113590b3b7fa412fb41

SHA512
ba46e149a32b82a3076d4d518bc8da3460ece50da5a01c46845354119499539862ec2b6d9a7fcd13e3e5c7e8e4b604592c615658315bcd627a931534a9089dcd

Download Submit
\Users\Admin\woepae.exe
Filesize
192KB

MD5
1d6707762ce5239aa26f2a0e0d0cf78b

SHA1
5fb529442ccf6353d2fdbd2c929915002631485b

SHA256
3924e867f6397c66e61f96d090e9bd246c0f9c0a8ae23113590b3b7fa412fb41

SHA512
ba46e149a32b82a3076d4d518bc8da3460ece50da5a01c46845354119499539862ec2b6d9a7fcd13e3e5c7e8e4b604592c615658315bcd627a931534a9089dcd

Download Submit
\Users\Admin\woepae.exe
Filesize
192KB

MD5
1d6707762ce5239aa26f2a0e0d0cf78b

SHA1
5fb529442ccf6353d2fdbd2c929915002631485b

SHA256
3924e867f6397c66e61f96d090e9bd246c0f9c0a8ae23113590b3b7fa412fb41

SHA512
ba46e149a32b82a3076d4d518bc8da3460ece50da5a01c46845354119499539862ec2b6d9a7fcd13e3e5c7e8e4b604592c615658315bcd627a931534a9089dcd

Download Submit
memory/1732-56-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1748-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads