40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834

General

Target

40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe
Size

320KB
MD5

5eb493f8d0d17a70eef7609e92ec1e08
SHA1

352951067a8ec59a5c25db4b82369a4ee366f8e0
SHA256

40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834
SHA512

38662b27824328ff59e63ddcf5a26fe954f7a5b4f4d2a3a94514ccbab1d59b6b69dfd9ea5c3587285d168aa87c0de521fe35b98dccce8294f817121625de1237
SSDEEP

6144:mLXiGKI//d8xgN3+E9xz3DfQr1w2O6EU02DPp9nrg5G35aJevhRGGhfZkEscw0Lc:oKg9+EDEnhtHAJevHsEscw0Lcqk

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exesuisa.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	suisa.exe

Executes dropped EXE 1 IoCs

Processes:

suisa.exe

pid process

1464 suisa.exe

pid	process
1464	suisa.exe

Loads dropped DLL 2 IoCs

Processes:

40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe

pid	process
856	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe
856	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe

Adds Run key to start application 2 TTPs 43 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

suisa.exe40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /g"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /E"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /K"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /D"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /b"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /p"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /a"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /k"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /U"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /W"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /F"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /n"	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /M"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /N"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /q"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /i"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /L"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /v"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /h"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /X"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /Y"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /H"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /G"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /Q"	suisa.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /d"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /t"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /R"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /j"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /Z"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /m"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /u"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /s"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /C"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /c"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /B"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /n"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /S"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /l"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /y"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /O"	suisa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\suisa = "C:\\Users\\Admin\\suisa.exe /z"	suisa.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exesuisa.exe

pid	process
856	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe
1464	suisa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exesuisa.exe

pid process

856 40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe
1464 suisa.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe

description	pid	process	target process
PID 856 wrote to memory of 1464	856	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe	suisa.exe
PID 856 wrote to memory of 1464	856	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe	suisa.exe
PID 856 wrote to memory of 1464	856	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe	suisa.exe
PID 856 wrote to memory of 1464	856	40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe	suisa.exe

C:\Users\Admin\AppData\Local\Temp\40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe
"C:\Users\Admin\AppData\Local\Temp\40e1d1d5c9cf760c8c84d6d1283b71dd8d281cde0fcf041ad779df681140f834.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Users\Admin\suisa.exe
"C:\Users\Admin\suisa.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\suisa.exe

Filesize
320KB

MD5
4ca881bdf31ac2a3424da96c85f274f3

SHA1
af137649c214f1551a93f2a209b12248a2d62c9e

SHA256
9e4a286719de4a25b4575bf8e243e4c23e37e884641efd25e50cd55014ac6cae

SHA512
33a3c2c450259ad697b26f9ad32a42f533345b0b5a258b34825656283b5070f5dd2e1002f96e7e3fd1913cc9f2d10da8b88ea317db3c588bb095c3d973dc3ca1

Download Submit
C:\Users\Admin\suisa.exe

Filesize
320KB

MD5
4ca881bdf31ac2a3424da96c85f274f3

SHA1
af137649c214f1551a93f2a209b12248a2d62c9e

SHA256
9e4a286719de4a25b4575bf8e243e4c23e37e884641efd25e50cd55014ac6cae

SHA512
33a3c2c450259ad697b26f9ad32a42f533345b0b5a258b34825656283b5070f5dd2e1002f96e7e3fd1913cc9f2d10da8b88ea317db3c588bb095c3d973dc3ca1

Download Submit
\Users\Admin\suisa.exe

Filesize
320KB

MD5
4ca881bdf31ac2a3424da96c85f274f3

SHA1
af137649c214f1551a93f2a209b12248a2d62c9e

SHA256
9e4a286719de4a25b4575bf8e243e4c23e37e884641efd25e50cd55014ac6cae

SHA512
33a3c2c450259ad697b26f9ad32a42f533345b0b5a258b34825656283b5070f5dd2e1002f96e7e3fd1913cc9f2d10da8b88ea317db3c588bb095c3d973dc3ca1

Download Submit
\Users\Admin\suisa.exe

Filesize
320KB

MD5
4ca881bdf31ac2a3424da96c85f274f3

SHA1
af137649c214f1551a93f2a209b12248a2d62c9e

SHA256
9e4a286719de4a25b4575bf8e243e4c23e37e884641efd25e50cd55014ac6cae

SHA512
33a3c2c450259ad697b26f9ad32a42f533345b0b5a258b34825656283b5070f5dd2e1002f96e7e3fd1913cc9f2d10da8b88ea317db3c588bb095c3d973dc3ca1

Download Submit
memory/856-56-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1464-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads