Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:37
Static task
static1
Behavioral task
behavioral1
Sample
dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe
Resource
win10v2004-20220812-en
General
-
Target
dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe
-
Size
244KB
-
MD5
557a9d01550f64f357195db9982e6318
-
SHA1
b38c9a8ed1ef5f8bb10afe72ae8442d035cfdd6f
-
SHA256
dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f
-
SHA512
28d6e90c4bd757aa51ec59d72376ce6e1a1ffd94c2c6f231dbd1b2ec3722bf19366df3a77c3cb9adf03a76177eaa503708df02fad3b5ca76dc74788a863044eb
-
SSDEEP
3072:bhPBd/sROnFQP5yIuSP9lqVinU3bp/PTm2moJ6BwA+GABMndgfaU:bhJdM7PnqVinU3bw2moJ6WAdgy
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exereauc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" reauc.exe -
Executes dropped EXE 1 IoCs
Processes:
reauc.exepid process 3292 reauc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe -
Adds Run key to start application 2 TTPs 29 IoCs
Processes:
reauc.exedd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /r" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /s" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /n" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /x" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /m" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /y" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /w" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /j" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /h" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /k" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /v" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /g" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /c" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /p" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /b" reauc.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /q" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /t" reauc.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /d" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /a" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /l" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /f" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /i" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /o" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /e" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /q" dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /z" reauc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reauc = "C:\\Users\\Admin\\reauc.exe /u" reauc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exereauc.exepid process 3564 dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe 3564 dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe 3292 reauc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exereauc.exepid process 3564 dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe 3292 reauc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exedescription pid process target process PID 3564 wrote to memory of 3292 3564 dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe reauc.exe PID 3564 wrote to memory of 3292 3564 dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe reauc.exe PID 3564 wrote to memory of 3292 3564 dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe reauc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe"C:\Users\Admin\AppData\Local\Temp\dd7f87993993550179c238abfb97c8bf9553b821a069423c4c930cfed8c2de1f.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\reauc.exe"C:\Users\Admin\reauc.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\reauc.exeFilesize
244KB
MD54bb4d56bd9fb1e34d0bde068c620457a
SHA1ccacc41fdaa6059fd28de4ca2b22e3d31fc31ce1
SHA25682d317a21069c4307967cb3a8f42748926eaafa3108eb6576c6ccede9526a24a
SHA512281b4535482ffa51d4a6a5bdbb99bc5db2ffb28ee49c96e6e064d6af09f74868e34d66bd77c94836ecf34dac819bf0b03225aac25c4592217a7f288d0108f0d0
-
C:\Users\Admin\reauc.exeFilesize
244KB
MD54bb4d56bd9fb1e34d0bde068c620457a
SHA1ccacc41fdaa6059fd28de4ca2b22e3d31fc31ce1
SHA25682d317a21069c4307967cb3a8f42748926eaafa3108eb6576c6ccede9526a24a
SHA512281b4535482ffa51d4a6a5bdbb99bc5db2ffb28ee49c96e6e064d6af09f74868e34d66bd77c94836ecf34dac819bf0b03225aac25c4592217a7f288d0108f0d0
-
memory/3292-134-0x0000000000000000-mapping.dmp