Analysis
-
max time kernel
205s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe
Resource
win10v2004-20220812-en
General
-
Target
3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe
-
Size
108KB
-
MD5
49775d19eb3c15b18f9e17dc9461ca06
-
SHA1
353f0ac07e674032291c5b967c302abcd1ad9619
-
SHA256
3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130
-
SHA512
41d8e24d5f4aba46d46bd13c430ffc8dca22b324dc981b8cee69ad3d331a79091407bf4ba0cccaeb36e2a74fb2d21d7fc64f1cbe9f18d059bb4f4290e40fc5b4
-
SSDEEP
1536:JKZSPvOJofZMf8G6oX9aHyELqOW3GFw7vwmqFkyYpWe5srvIyiA+UWI5Q0wXT50h:Xv7oX9EO7LqW3XHCnLl
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exehslut.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hslut.exe -
Executes dropped EXE 1 IoCs
Processes:
hslut.exepid process 2356 hslut.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe -
Adds Run key to start application 2 TTPs 55 IoCs
Processes:
hslut.exe3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /I" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /C" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /M" hslut.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /R" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /P" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /h" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /H" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /o" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /G" 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /X" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /j" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /w" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /i" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /s" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /u" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /c" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /r" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /K" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /z" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /A" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /d" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /G" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /D" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /S" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /x" hslut.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /f" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /N" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /m" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /V" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /b" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /g" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /v" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /q" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /B" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /e" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /F" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /L" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /p" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /W" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /l" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /T" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /a" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /k" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /O" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /E" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /Q" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /J" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /Y" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /U" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /y" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /t" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /Z" hslut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hslut = "C:\\Users\\Admin\\hslut.exe /n" hslut.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exehslut.exepid process 3408 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe 3408 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe 2356 hslut.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exehslut.exepid process 3408 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe 2356 hslut.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exedescription pid process target process PID 3408 wrote to memory of 2356 3408 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe hslut.exe PID 3408 wrote to memory of 2356 3408 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe hslut.exe PID 3408 wrote to memory of 2356 3408 3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe hslut.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe"C:\Users\Admin\AppData\Local\Temp\3da663fd151b180bb43f07316e5f1ab8fca9e870103c195b75da625b1d447130.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\hslut.exe"C:\Users\Admin\hslut.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2356
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\hslut.exeFilesize
108KB
MD5d5e3a91bea8cfab6cbaa0f10b2e200f1
SHA13f4411c3fc0e504667095536e5b5226155e9a308
SHA2566cf6aab6346d7984ea360b81ca2bda7068e0b5580961771c8c6a0c1efc6d0e5f
SHA512107966c4d7605028591ab12b77f28502a2f11b0c1c9737855329a8bba91039eb2866c46ec2dfe615594bb7d77e43cba19354cea5aedeee5ee7ec343ce292befb
-
C:\Users\Admin\hslut.exeFilesize
108KB
MD5d5e3a91bea8cfab6cbaa0f10b2e200f1
SHA13f4411c3fc0e504667095536e5b5226155e9a308
SHA2566cf6aab6346d7984ea360b81ca2bda7068e0b5580961771c8c6a0c1efc6d0e5f
SHA512107966c4d7605028591ab12b77f28502a2f11b0c1c9737855329a8bba91039eb2866c46ec2dfe615594bb7d77e43cba19354cea5aedeee5ee7ec343ce292befb
-
memory/2356-134-0x0000000000000000-mapping.dmp