Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 18:48
Static task
static1
Behavioral task
behavioral1
Sample
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe
Resource
win10v2004-20220812-en
General
-
Target
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe
-
Size
135KB
-
MD5
041ab83aee312c75d6fae5c8c45ef590
-
SHA1
2bcdc73be4ea53dec47e6805cb11a7f30fb15563
-
SHA256
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866
-
SHA512
f1c89108a18631aac7054f2af4f0d4918b784a3c6aa116acff0fcd163a7acb7bfdc6f1221f5e7e1058932022f99ade126748fd2ce25844c326effb3cfa258c7e
-
SSDEEP
3072:Qm7PefLUPb1WpXVxAaGBvbNvNbNJkvmhyPQbaDTUXGIDbwKDqCtrwdAxaVTtVHLu:tHoIDbByGPMsMP
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
nauup.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nauup.exe -
Executes dropped EXE 1 IoCs
Processes:
nauup.exepid process 1528 nauup.exe -
Loads dropped DLL 2 IoCs
Processes:
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exepid process 1272 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe 1272 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
nauup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ nauup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nauup = "C:\\Users\\Admin\\nauup.exe" nauup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
nauup.exepid process 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe 1528 nauup.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exenauup.exepid process 1272 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe 1528 nauup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exenauup.exedescription pid process target process PID 1272 wrote to memory of 1528 1272 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe nauup.exe PID 1272 wrote to memory of 1528 1272 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe nauup.exe PID 1272 wrote to memory of 1528 1272 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe nauup.exe PID 1272 wrote to memory of 1528 1272 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe nauup.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 1528 wrote to memory of 1272 1528 nauup.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe"C:\Users\Admin\AppData\Local\Temp\6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\nauup.exe"C:\Users\Admin\nauup.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\nauup.exeFilesize
135KB
MD5ab99f8ccddf07230560646805fce589c
SHA1f15533a37055d1b1bf3c57b80fbd12f1d2041b87
SHA25655ec4f5908d2e262bc12a5a0911a66f1d5c19fe1484e35be3d918b2987880462
SHA51242b378eb91d60613b1bd01337a05a530e10a5aa52e21103bde745bc8faf161d358a9c5ad988e24c98227fdd1a60fcb478c9d236b1e1e2a6ba8bb2a1a4bfec021
-
C:\Users\Admin\nauup.exeFilesize
135KB
MD5ab99f8ccddf07230560646805fce589c
SHA1f15533a37055d1b1bf3c57b80fbd12f1d2041b87
SHA25655ec4f5908d2e262bc12a5a0911a66f1d5c19fe1484e35be3d918b2987880462
SHA51242b378eb91d60613b1bd01337a05a530e10a5aa52e21103bde745bc8faf161d358a9c5ad988e24c98227fdd1a60fcb478c9d236b1e1e2a6ba8bb2a1a4bfec021
-
\Users\Admin\nauup.exeFilesize
135KB
MD5ab99f8ccddf07230560646805fce589c
SHA1f15533a37055d1b1bf3c57b80fbd12f1d2041b87
SHA25655ec4f5908d2e262bc12a5a0911a66f1d5c19fe1484e35be3d918b2987880462
SHA51242b378eb91d60613b1bd01337a05a530e10a5aa52e21103bde745bc8faf161d358a9c5ad988e24c98227fdd1a60fcb478c9d236b1e1e2a6ba8bb2a1a4bfec021
-
\Users\Admin\nauup.exeFilesize
135KB
MD5ab99f8ccddf07230560646805fce589c
SHA1f15533a37055d1b1bf3c57b80fbd12f1d2041b87
SHA25655ec4f5908d2e262bc12a5a0911a66f1d5c19fe1484e35be3d918b2987880462
SHA51242b378eb91d60613b1bd01337a05a530e10a5aa52e21103bde745bc8faf161d358a9c5ad988e24c98227fdd1a60fcb478c9d236b1e1e2a6ba8bb2a1a4bfec021
-
memory/1272-56-0x0000000075C41000-0x0000000075C43000-memory.dmpFilesize
8KB
-
memory/1528-59-0x0000000000000000-mapping.dmp