fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d

General

Target

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
Size

220KB
MD5

4d2ecaee7d1124a4e17f1cac127f2b96
SHA1

6f0bc78ae426bd42400a4472bab258585257bb4c
SHA256

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d
SHA512

23fa24ebdf72966877d08a9460976978c95d050268b018c07a7dce9fa21321336474fd4bba47f04ae06761b0ee9f40847a9a7ad37885cbf0385468c3260f0df0
SSDEEP

3072:PUOu+kr8YUL4qx9RIHgil3UuhSa3U3dD8d6Oy+MIrnj3J+Nhi:cO7ko15x9SHVeOj0Q

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exeboobi.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	boobi.exe

Executes dropped EXE 1 IoCs

Processes:

boobi.exe

pid process

2492 boobi.exe

pid	process
2492	boobi.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

boobi.exefa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /f"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /d"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /x"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /o"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /j"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /c"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /a"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /p"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /h"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /k"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /b"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /v"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /t"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /m"	boobi.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /q"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /n"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /e"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /g"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /y"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /u"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /l"	boobi.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /r"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /i"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /z"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /p"	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /w"	boobi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boobi = "C:\\Users\\Admin\\boobi.exe /s"	boobi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exeboobi.exe

pid	process
4160	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
4160	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe
2492	boobi.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exeboobi.exe

pid process

4160 fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
2492 boobi.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe

description	pid	process	target process
PID 4160 wrote to memory of 2492	4160	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe	boobi.exe
PID 4160 wrote to memory of 2492	4160	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe	boobi.exe
PID 4160 wrote to memory of 2492	4160	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe	boobi.exe

C:\Users\Admin\AppData\Local\Temp\fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
"C:\Users\Admin\AppData\Local\Temp\fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160

C:\Users\Admin\boobi.exe
"C:\Users\Admin\boobi.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\boobi.exe

Filesize
220KB

MD5
cf2b8b47f5db255507cc18b57b1b12a3

SHA1
a3152556f99e254e164b6053774239b463ca7e9f

SHA256
b307ee52baa32ec84f6670dedc12423528a51a5558f60c0a7d799eb902196ff7

SHA512
a66bec1068888de6429f6637ce863a1811e62c49677efced9afdf927d480f8e2599966a4e25605727ebde103570616d0ec41d0a89e15a0e58cf410755af5c865

Download Submit
C:\Users\Admin\boobi.exe

Filesize
220KB

MD5
cf2b8b47f5db255507cc18b57b1b12a3

SHA1
a3152556f99e254e164b6053774239b463ca7e9f

SHA256
b307ee52baa32ec84f6670dedc12423528a51a5558f60c0a7d799eb902196ff7

SHA512
a66bec1068888de6429f6637ce863a1811e62c49677efced9afdf927d480f8e2599966a4e25605727ebde103570616d0ec41d0a89e15a0e58cf410755af5c865

Download Submit
memory/2492-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads