5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729

General

Target

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
Size

180KB
MD5

2b602be7dea84758ed540f5c367cf9a3
SHA1

e1eb2ca034493f4bada29682e0998c8504a9dab3
SHA256

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729
SHA512

6d9d2b038c19e9291d7e45f1c94c923f7cc1d7ff6e051c80b95021f5f261d4a8c5332b5900e35e4eaf48e05596af749ceab320175f9298d11664afbf9e1a8bb5
SSDEEP

3072:6IN4GdYRLoeEdRos/eaqFnqWDb+uTyLDC6s5sSYqGlC6YViZj5HQXZmmJ0yCFiof:VNpcKPpm2lC6YViZj5HQXZmmJ0yCF9Bk

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exejieugub.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jieugub.exe

Executes dropped EXE 1 IoCs

Processes:

jieugub.exe

pid process

956 jieugub.exe

pid	process
956	jieugub.exe

Loads dropped DLL 2 IoCs

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe

pid	process
2040	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
2040	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

jieugub.exe5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /m"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /Y"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /L"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /x"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /S"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /G"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /d"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /U"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /O"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /j"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /B"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /M"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /p"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /w"	jieugub.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /H"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /W"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /V"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /n"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /z"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /u"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /r"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /D"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /g"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /K"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /i"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /J"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /F"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /e"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /f"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /Q"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /t"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /N"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /C"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /P"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /E"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /c"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /q"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /I"	jieugub.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /j"	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /s"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /T"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /o"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /y"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /X"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /h"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /b"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /R"	jieugub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieugub = "C:\\Users\\Admin\\jieugub.exe /A"	jieugub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exejieugub.exe

pid	process
2040	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe
956	jieugub.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exejieugub.exe

pid process

2040 5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
956 jieugub.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe

description	pid	process	target process
PID 2040 wrote to memory of 956	2040	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe	jieugub.exe
PID 2040 wrote to memory of 956	2040	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe	jieugub.exe
PID 2040 wrote to memory of 956	2040	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe	jieugub.exe
PID 2040 wrote to memory of 956	2040	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe	jieugub.exe

C:\Users\Admin\AppData\Local\Temp\5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
"C:\Users\Admin\AppData\Local\Temp\5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\jieugub.exe
"C:\Users\Admin\jieugub.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\jieugub.exe

Filesize
180KB

MD5
2a94f601594a2043b0bb88ca0c35b425

SHA1
cd10bc074035dbb1482645891b158ed54abe5b14

SHA256
cea377709ff255f35686dfc1cee305d4c3ddc4d306d715ebee3fdd8809bd82de

SHA512
09d54427143fd1dbf2f1c010a4db56500e36d43b259afa3c728cc5e6967865ad9c100fb10904f3e2c2627f72e2994bdba515502935978ec9e8a041f1e40bb2bf

Download Submit
C:\Users\Admin\jieugub.exe

Filesize
180KB

MD5
2a94f601594a2043b0bb88ca0c35b425

SHA1
cd10bc074035dbb1482645891b158ed54abe5b14

SHA256
cea377709ff255f35686dfc1cee305d4c3ddc4d306d715ebee3fdd8809bd82de

SHA512
09d54427143fd1dbf2f1c010a4db56500e36d43b259afa3c728cc5e6967865ad9c100fb10904f3e2c2627f72e2994bdba515502935978ec9e8a041f1e40bb2bf

Download Submit
\Users\Admin\jieugub.exe

Filesize
180KB

MD5
2a94f601594a2043b0bb88ca0c35b425

SHA1
cd10bc074035dbb1482645891b158ed54abe5b14

SHA256
cea377709ff255f35686dfc1cee305d4c3ddc4d306d715ebee3fdd8809bd82de

SHA512
09d54427143fd1dbf2f1c010a4db56500e36d43b259afa3c728cc5e6967865ad9c100fb10904f3e2c2627f72e2994bdba515502935978ec9e8a041f1e40bb2bf

Download Submit
\Users\Admin\jieugub.exe

Filesize
180KB

MD5
2a94f601594a2043b0bb88ca0c35b425

SHA1
cd10bc074035dbb1482645891b158ed54abe5b14

SHA256
cea377709ff255f35686dfc1cee305d4c3ddc4d306d715ebee3fdd8809bd82de

SHA512
09d54427143fd1dbf2f1c010a4db56500e36d43b259afa3c728cc5e6967865ad9c100fb10904f3e2c2627f72e2994bdba515502935978ec9e8a041f1e40bb2bf

Download Submit
memory/956-59-0x0000000000000000-mapping.dmp

Download
memory/2040-56-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads