Analysis
-
max time kernel
151s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 19:04
Static task
static1
Behavioral task
behavioral1
Sample
0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe
Resource
win10v2004-20220812-en
General
-
Target
0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe
-
Size
132KB
-
MD5
597587f5a1ef252a6b6e23a1dc8dbfe0
-
SHA1
bae291bfdd8ee0199024f9c0bb3765a029a80103
-
SHA256
0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231
-
SHA512
28f08ec66e35197fedeeec8002593738be62c5b9c86caef897643fd9dbd76d5081e75b8c4d80b0063a983da638c494a1325fbfff143d4bc2eb27ef3ffb5c2c33
-
SSDEEP
3072:fanf/b6NUf6VRlxzhPak8LXo46sBizQiOku:4/biUSVPxNPaLLXoNii8iC
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
daeayec.exe0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" daeayec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe -
Executes dropped EXE 1 IoCs
Processes:
daeayec.exepid process 852 daeayec.exe -
Loads dropped DLL 2 IoCs
Processes:
0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exepid process 1956 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe 1956 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe -
Adds Run key to start application 2 TTPs 49 IoCs
Processes:
daeayec.exe0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /c" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /T" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /a" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /r" daeayec.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /M" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /O" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /n" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /y" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /Y" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /H" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /v" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /w" 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /N" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /b" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /R" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /X" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /h" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /t" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /U" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /F" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /K" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /D" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /u" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /q" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /j" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /f" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /V" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /G" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /g" daeayec.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /Q" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /S" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /C" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /p" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /I" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /d" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /w" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /s" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /m" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /k" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /P" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /e" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /L" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /B" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /Z" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /o" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /x" daeayec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\daeayec = "C:\\Users\\Admin\\daeayec.exe /W" daeayec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exedaeayec.exepid process 1956 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe 852 daeayec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exedaeayec.exepid process 1956 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe 852 daeayec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exedescription pid process target process PID 1956 wrote to memory of 852 1956 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe daeayec.exe PID 1956 wrote to memory of 852 1956 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe daeayec.exe PID 1956 wrote to memory of 852 1956 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe daeayec.exe PID 1956 wrote to memory of 852 1956 0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe daeayec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe"C:\Users\Admin\AppData\Local\Temp\0f059ba1a32550d2ff589b301e216817d3195b957bfc8cc3d38c2c7bac4a0231.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\daeayec.exe"C:\Users\Admin\daeayec.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:852
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5b7182d71703935c901b50a9df273a306
SHA123ddf86237e9b1d7d1f39f7d85872c10cbadaba2
SHA256088f844ee5c9fadd60dc52f592b472c20fa10b217f16cf9f31f06c636024af13
SHA512b06c9e01ea1f417238e3cbf038e43d7175092b9444fc5757140e62d0387b621d4b3dd0c232920bb3c2c9ea13ebf0c7b4f5e2a42bede24e9fbc0206cc2a413e39
-
Filesize
132KB
MD5b7182d71703935c901b50a9df273a306
SHA123ddf86237e9b1d7d1f39f7d85872c10cbadaba2
SHA256088f844ee5c9fadd60dc52f592b472c20fa10b217f16cf9f31f06c636024af13
SHA512b06c9e01ea1f417238e3cbf038e43d7175092b9444fc5757140e62d0387b621d4b3dd0c232920bb3c2c9ea13ebf0c7b4f5e2a42bede24e9fbc0206cc2a413e39
-
Filesize
132KB
MD5b7182d71703935c901b50a9df273a306
SHA123ddf86237e9b1d7d1f39f7d85872c10cbadaba2
SHA256088f844ee5c9fadd60dc52f592b472c20fa10b217f16cf9f31f06c636024af13
SHA512b06c9e01ea1f417238e3cbf038e43d7175092b9444fc5757140e62d0387b621d4b3dd0c232920bb3c2c9ea13ebf0c7b4f5e2a42bede24e9fbc0206cc2a413e39
-
Filesize
132KB
MD5b7182d71703935c901b50a9df273a306
SHA123ddf86237e9b1d7d1f39f7d85872c10cbadaba2
SHA256088f844ee5c9fadd60dc52f592b472c20fa10b217f16cf9f31f06c636024af13
SHA512b06c9e01ea1f417238e3cbf038e43d7175092b9444fc5757140e62d0387b621d4b3dd0c232920bb3c2c9ea13ebf0c7b4f5e2a42bede24e9fbc0206cc2a413e39