943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb

General

Target

943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe
Size

124KB
MD5

453c7c22f70ca1a8f39a308b1bc8a250
SHA1

4f0f13f43bb9c5924ebde4f96dcf581cf2d0def9
SHA256

943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb
SHA512

afae49c34583d21d8e084b168ab8a0259d377bc03851ba3dd20532f97ddebc93f897b4ff60384a09e009de2e7cbb2c7de7a19cc0ca3a76432b7cbf993c18686a
SSDEEP

1536:9nJ9pdA+ZU0GgAYu0P1kNmwldCMhdu8KWP/nTn8nBP9VeMNeG0h/E:j9p2AU0GgA89gM

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exewuuzaaw.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wuuzaaw.exe

Executes dropped EXE 1 IoCs

Processes:

wuuzaaw.exe

pid process

2828 wuuzaaw.exe

pid	process
2828	wuuzaaw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wuuzaaw.exe943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /J"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /y"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /I"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /l"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /v"	943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /v"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /e"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /H"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /C"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /k"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /E"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /T"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /h"	wuuzaaw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /Y"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /x"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /d"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /o"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /X"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /q"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /M"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /w"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /p"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /a"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /L"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /m"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /Q"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /i"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /n"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /f"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /K"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /S"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /O"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /F"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /c"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /r"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /R"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /g"	wuuzaaw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /N"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /G"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /V"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /t"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /u"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /U"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /W"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /z"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /D"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /Z"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /B"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /A"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /b"	wuuzaaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuuzaaw = "C:\\Users\\Admin\\wuuzaaw.exe /P"	wuuzaaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exewuuzaaw.exe

pid	process
2472	943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe
2472	943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe
2828	wuuzaaw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exewuuzaaw.exe

pid process

2472 943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe
2828 wuuzaaw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe

description	pid	process	target process
PID 2472 wrote to memory of 2828	2472	943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe	wuuzaaw.exe
PID 2472 wrote to memory of 2828	2472	943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe	wuuzaaw.exe
PID 2472 wrote to memory of 2828	2472	943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe	wuuzaaw.exe

C:\Users\Admin\AppData\Local\Temp\943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe
"C:\Users\Admin\AppData\Local\Temp\943665f250a49a53dbc426361798c8010f7e429dbb02aa8e56bc304488527dbb.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\wuuzaaw.exe
"C:\Users\Admin\wuuzaaw.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\wuuzaaw.exe

Filesize
124KB

MD5
4c8db97731157fd31af12b951d372b61

SHA1
27d4e8543a732c4e4b4303fd50bb2ad2faf395da

SHA256
52bd5590093eb6e1c82089340df830242a93edd08298cb79c7c3b46cf492ffe4

SHA512
44ef2acefca7024352e0c1fa8eee187c75c8ac2d6c37270909f4224d39986235dcb050ec46f6a28b1bbc373f8100e80460a865bfee205b12a87d8b7c7cb67fc3

Download Submit
C:\Users\Admin\wuuzaaw.exe

Filesize
124KB

MD5
4c8db97731157fd31af12b951d372b61

SHA1
27d4e8543a732c4e4b4303fd50bb2ad2faf395da

SHA256
52bd5590093eb6e1c82089340df830242a93edd08298cb79c7c3b46cf492ffe4

SHA512
44ef2acefca7024352e0c1fa8eee187c75c8ac2d6c37270909f4224d39986235dcb050ec46f6a28b1bbc373f8100e80460a865bfee205b12a87d8b7c7cb67fc3

Download Submit
memory/2828-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads