67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c

General

Target

67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
Size

200KB
MD5

5cc267d2ba4689e197dac3025046e260
SHA1

7ea97b226cc20da133e6e627224f0a654b3f9ab5
SHA256

67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c
SHA512

2df8978a9230f472a0689b768b28ce360775bfae356b0a6ed084ff3d217ffb56c9b7c5f2a5e34ff2a6b638d91618f680c7241a8d9e80d0f83d322061d50b29e6
SSDEEP

3072:DTtcstTstk/pSBAFtbCduLCADMcgg7ker:ftcATstk/pp2ADMVC

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

heeqoez.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	heeqoez.exe

Executes dropped EXE 1 IoCs

Processes:

heeqoez.exe

pid process

2188 heeqoez.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

heeqoez.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /g"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /O"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /w"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /i"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /u"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /c"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /j"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /A"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /U"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /I"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /z"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /t"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /H"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /C"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /x"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /L"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /v"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /Z"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /r"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /X"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /o"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /V"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /B"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /l"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /E"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /R"	heeqoez.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /G"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /Y"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /y"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /S"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /J"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /K"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /e"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /d"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /W"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /a"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /m"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /D"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /s"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /k"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /P"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /n"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /h"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /T"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /p"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /F"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /Q"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /M"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /N"	heeqoez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heeqoez = "C:\\Users\\Admin\\heeqoez.exe /q"	heeqoez.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

heeqoez.exe

pid	process
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe
2188	heeqoez.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exeheeqoez.exe

pid process

4208 67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
2188 heeqoez.exe

pid	process
4208	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
2188	heeqoez.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exeheeqoez.exe

description	pid	process	target process
PID 4208 wrote to memory of 2188	4208	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe	heeqoez.exe
PID 4208 wrote to memory of 2188	4208	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe	heeqoez.exe
PID 4208 wrote to memory of 2188	4208	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe	heeqoez.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
PID 2188 wrote to memory of 4208	2188	heeqoez.exe	67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe

C:\Users\Admin\AppData\Local\Temp\67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe
"C:\Users\Admin\AppData\Local\Temp\67251cb15ae25b777b0677244d0fab369be57f25779b79674439a6b50787b04c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208

C:\Users\Admin\heeqoez.exe
"C:\Users\Admin\heeqoez.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\heeqoez.exe
Filesize
200KB

MD5
b85587c94e4f23015dcdb06f24e6b469

SHA1
95704a3980dc554a7ea29208c3635a347cf6dbc0

SHA256
976352de26ff1f82651a9f98246e6d55c1746c47cc7af9b6ce2f355b465a68e0

SHA512
c464206c43c501840b9a87ee7535636e6d207f1d2c707f3a297dee688fd053a66d6ef1b3a37a5975eb10827aab87a7a272efcb40e84c1a67217f76706725c5e0

Download Submit
C:\Users\Admin\heeqoez.exe
Filesize
200KB

MD5
b85587c94e4f23015dcdb06f24e6b469

SHA1
95704a3980dc554a7ea29208c3635a347cf6dbc0

SHA256
976352de26ff1f82651a9f98246e6d55c1746c47cc7af9b6ce2f355b465a68e0

SHA512
c464206c43c501840b9a87ee7535636e6d207f1d2c707f3a297dee688fd053a66d6ef1b3a37a5975eb10827aab87a7a272efcb40e84c1a67217f76706725c5e0

Download Submit
memory/2188-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads