aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327

General

Target

aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
Size

353KB
MD5

5ad6fe98791d50aebc810faa406e9740
SHA1

6e8f536a2f429a52e106017cff0f5cbcbc7c847b
SHA256

aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327
SHA512

f58d754bd9c251e71c6b9f78997da75db6353b687710e7c3b90da80d2a8857da6bd67de51f67951d8d5d586f938cf151aeaf9836d9826c21a9b11b191aac3a11
SSDEEP

3072:Df1LWNcvRjlAvufOrNMxbVDtEDUvIUyd0:pvjlAvufOJMxYDUr

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

guieyo.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	guieyo.exe

Executes dropped EXE 1 IoCs

Processes:

guieyo.exe

pid process

1600 guieyo.exe

Loads dropped DLL 2 IoCs

Processes:

aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe

pid	process
1604	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
1604	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

guieyo.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	guieyo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\guieyo = "C:\\Users\\Admin\\guieyo.exe"	guieyo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

guieyo.exe

pid	process
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe
1600	guieyo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exeguieyo.exe

pid process

1604 aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
1600 guieyo.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exeguieyo.exe

description	pid	process	target process
PID 1604 wrote to memory of 1600	1604	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe	guieyo.exe
PID 1604 wrote to memory of 1600	1604	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe	guieyo.exe
PID 1604 wrote to memory of 1600	1604	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe	guieyo.exe
PID 1604 wrote to memory of 1600	1604	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe	guieyo.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
PID 1600 wrote to memory of 1604	1600	guieyo.exe	aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe

C:\Users\Admin\AppData\Local\Temp\aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe
"C:\Users\Admin\AppData\Local\Temp\aee6e3a6647bf60965fb9208ff468dac5742d6d727fc2ce4377740fbda877327.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\guieyo.exe
  "C:\Users\Admin\guieyo.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\guieyo.exe

Filesize
353KB

MD5
bf8266d8fff94dd0c38f368364b32f32

SHA1
a84cee7fc5b76822bf31c5520d933f6e69333f0e

SHA256
905c230523a2f7ccd8d5069a77b5512f2bafebe21a2b6c096a2a7ab059fad1e8

SHA512
673dd80e9eb0c49b1e1eb59383d559c9f168b84bded5b91fb5f203a7449831ab417bf2e6c3929cb5427387d82c07b5e4bad5303c4d42277502ec4ddea2f8389d

Download Submit
C:\Users\Admin\guieyo.exe

Filesize
353KB

MD5
bf8266d8fff94dd0c38f368364b32f32

SHA1
a84cee7fc5b76822bf31c5520d933f6e69333f0e

SHA256
905c230523a2f7ccd8d5069a77b5512f2bafebe21a2b6c096a2a7ab059fad1e8

SHA512
673dd80e9eb0c49b1e1eb59383d559c9f168b84bded5b91fb5f203a7449831ab417bf2e6c3929cb5427387d82c07b5e4bad5303c4d42277502ec4ddea2f8389d

Download Submit
\Users\Admin\guieyo.exe

Filesize
353KB

MD5
bf8266d8fff94dd0c38f368364b32f32

SHA1
a84cee7fc5b76822bf31c5520d933f6e69333f0e

SHA256
905c230523a2f7ccd8d5069a77b5512f2bafebe21a2b6c096a2a7ab059fad1e8

SHA512
673dd80e9eb0c49b1e1eb59383d559c9f168b84bded5b91fb5f203a7449831ab417bf2e6c3929cb5427387d82c07b5e4bad5303c4d42277502ec4ddea2f8389d

Download Submit
\Users\Admin\guieyo.exe

Filesize
353KB

MD5
bf8266d8fff94dd0c38f368364b32f32

SHA1
a84cee7fc5b76822bf31c5520d933f6e69333f0e

SHA256
905c230523a2f7ccd8d5069a77b5512f2bafebe21a2b6c096a2a7ab059fad1e8

SHA512
673dd80e9eb0c49b1e1eb59383d559c9f168b84bded5b91fb5f203a7449831ab417bf2e6c3929cb5427387d82c07b5e4bad5303c4d42277502ec4ddea2f8389d

Download Submit
memory/1600-60-0x0000000000000000-mapping.dmp

Download
memory/1600-67-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1600-70-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1604-56-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1604-57-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1604-66-0x00000000028B0000-0x000000000291D000-memory.dmp

Filesize
436KB

Download
memory/1604-65-0x00000000028B0000-0x000000000291D000-memory.dmp

Filesize
436KB

Download
memory/1604-69-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads