5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729

General

Target

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
Size

180KB
MD5

2b602be7dea84758ed540f5c367cf9a3
SHA1

e1eb2ca034493f4bada29682e0998c8504a9dab3
SHA256

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729
SHA512

6d9d2b038c19e9291d7e45f1c94c923f7cc1d7ff6e051c80b95021f5f261d4a8c5332b5900e35e4eaf48e05596af749ceab320175f9298d11664afbf9e1a8bb5
SSDEEP

3072:6IN4GdYRLoeEdRos/eaqFnqWDb+uTyLDC6s5sSYqGlC6YViZj5HQXZmmJ0yCFiof:VNpcKPpm2lC6YViZj5HQXZmmJ0yCF9Bk

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exepuiezaj.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	puiezaj.exe

Executes dropped EXE 1 IoCs

Processes:

puiezaj.exe

pid process

4716 puiezaj.exe

pid	process
4716	puiezaj.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

puiezaj.exe5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /b"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /v"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /o"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /E"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /A"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /n"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /N"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /Z"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /Y"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /d"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /m"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /C"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /q"	puiezaj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /j"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /I"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /y"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /a"	puiezaj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /t"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /X"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /w"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /z"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /u"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /r"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /R"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /L"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /g"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /S"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /J"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /x"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /H"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /K"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /D"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /l"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /V"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /h"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /P"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /p"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /U"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /F"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /G"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /c"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /B"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /R"	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /O"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /k"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /f"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /i"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /W"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /e"	puiezaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiezaj = "C:\\Users\\Admin\\puiezaj.exe /Q"	puiezaj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exepuiezaj.exe

pid	process
1856	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
1856	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe
4716	puiezaj.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exepuiezaj.exe

pid process

1856 5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
4716 puiezaj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe

description	pid	process	target process
PID 1856 wrote to memory of 4716	1856	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe	puiezaj.exe
PID 1856 wrote to memory of 4716	1856	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe	puiezaj.exe
PID 1856 wrote to memory of 4716	1856	5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe	puiezaj.exe

C:\Users\Admin\AppData\Local\Temp\5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe
"C:\Users\Admin\AppData\Local\Temp\5daaad90bf4aee9b3668ff1cea71df176eac3a692a0f359842c0d3c6e183f729.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856

C:\Users\Admin\puiezaj.exe
"C:\Users\Admin\puiezaj.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\puiezaj.exe

Filesize
180KB

MD5
0c20a655a35f92a21db72915a196aa34

SHA1
9212ccd71e82881596283480e8c01d14a245c6c0

SHA256
f414c581a4ef53f5716907edce4fa7e86217a40dcaccb8bb7c374b922c107733

SHA512
0cbcb80b20108153e2730a503b23cb2686c0aa5aa11bba5fe789c55bf4ef9b18aea279817db4b14daccb075c2e0847816637ee0ded1d1176f1500cfd07de91ea

Download Submit
C:\Users\Admin\puiezaj.exe

Filesize
180KB

MD5
0c20a655a35f92a21db72915a196aa34

SHA1
9212ccd71e82881596283480e8c01d14a245c6c0

SHA256
f414c581a4ef53f5716907edce4fa7e86217a40dcaccb8bb7c374b922c107733

SHA512
0cbcb80b20108153e2730a503b23cb2686c0aa5aa11bba5fe789c55bf4ef9b18aea279817db4b14daccb075c2e0847816637ee0ded1d1176f1500cfd07de91ea

Download Submit
memory/4716-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads