Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 18:55
Static task
static1
Behavioral task
behavioral1
Sample
1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe
Resource
win10v2004-20220812-en
General
-
Target
1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe
-
Size
184KB
-
MD5
45b535a3a40d47ef1de18fe1368f5900
-
SHA1
0f0c5b790f6d65864c8a0d7a88dba24bf7c20ab0
-
SHA256
1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0
-
SHA512
1bf527e7f633be040553f8e75621fd3203b2bb431bfd860a567ef89ab1dd453a91f018f40616a3f98713cf91694b1de930f36b276e53a61b151ad56807e44ac6
-
SSDEEP
3072:u7Ug+HWoYTzCh46Knvmb7/D26ytQlw/Lg5q69srijEIS3A:Mrpz6LKnvmb7/D26yQlw/Lg5qosri/Sw
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exetukiw.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tukiw.exe -
Executes dropped EXE 1 IoCs
Processes:
tukiw.exepid process 1956 tukiw.exe -
Loads dropped DLL 2 IoCs
Processes:
1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exepid process 536 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe 536 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe -
Adds Run key to start application 2 TTPs 54 IoCs
Processes:
tukiw.exe1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /q" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /Z" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /k" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /y" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /W" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /d" 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /J" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /p" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /I" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /D" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /C" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /t" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /H" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /f" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /P" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /M" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /x" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /d" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /V" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /c" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /m" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /l" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /i" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /U" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /s" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /a" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /X" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /j" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /z" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /n" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /r" tukiw.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /E" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /u" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /L" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /A" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /b" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /G" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /Q" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /O" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /R" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /w" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /T" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /h" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /e" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /g" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /B" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /K" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /N" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /Y" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /v" tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /S" tukiw.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ tukiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tukiw = "C:\\Users\\Admin\\tukiw.exe /F" tukiw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exetukiw.exepid process 536 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe 1956 tukiw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exetukiw.exepid process 536 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe 1956 tukiw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exedescription pid process target process PID 536 wrote to memory of 1956 536 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe tukiw.exe PID 536 wrote to memory of 1956 536 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe tukiw.exe PID 536 wrote to memory of 1956 536 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe tukiw.exe PID 536 wrote to memory of 1956 536 1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe tukiw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe"C:\Users\Admin\AppData\Local\Temp\1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\tukiw.exe"C:\Users\Admin\tukiw.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\tukiw.exeFilesize
184KB
MD5080f51967ea647fbdb2cf6cff9d19cda
SHA1fb16475c626d7f21ccab54e595e3e225dd7d9d55
SHA256f5782f39d8fe8060dea21ee66addb337a58632c4b676521041cda10af329a82a
SHA512e219c70a82af79cfbaea84a7083a9f7384ce9b77f75c2f74a308fe41a8de42dd74cfff93081f5e669d843c6568f654ff1bf8b36e6077b8d8573e11d15b115665
-
C:\Users\Admin\tukiw.exeFilesize
184KB
MD5080f51967ea647fbdb2cf6cff9d19cda
SHA1fb16475c626d7f21ccab54e595e3e225dd7d9d55
SHA256f5782f39d8fe8060dea21ee66addb337a58632c4b676521041cda10af329a82a
SHA512e219c70a82af79cfbaea84a7083a9f7384ce9b77f75c2f74a308fe41a8de42dd74cfff93081f5e669d843c6568f654ff1bf8b36e6077b8d8573e11d15b115665
-
\Users\Admin\tukiw.exeFilesize
184KB
MD5080f51967ea647fbdb2cf6cff9d19cda
SHA1fb16475c626d7f21ccab54e595e3e225dd7d9d55
SHA256f5782f39d8fe8060dea21ee66addb337a58632c4b676521041cda10af329a82a
SHA512e219c70a82af79cfbaea84a7083a9f7384ce9b77f75c2f74a308fe41a8de42dd74cfff93081f5e669d843c6568f654ff1bf8b36e6077b8d8573e11d15b115665
-
\Users\Admin\tukiw.exeFilesize
184KB
MD5080f51967ea647fbdb2cf6cff9d19cda
SHA1fb16475c626d7f21ccab54e595e3e225dd7d9d55
SHA256f5782f39d8fe8060dea21ee66addb337a58632c4b676521041cda10af329a82a
SHA512e219c70a82af79cfbaea84a7083a9f7384ce9b77f75c2f74a308fe41a8de42dd74cfff93081f5e669d843c6568f654ff1bf8b36e6077b8d8573e11d15b115665
-
memory/536-56-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1956-59-0x0000000000000000-mapping.dmp