Analysis
-
max time kernel
187s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:07
Static task
static1
Behavioral task
behavioral1
Sample
3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe
Resource
win10v2004-20221111-en
General
-
Target
3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe
-
Size
164KB
-
MD5
29180ae82803366ed8b3c74994f9312f
-
SHA1
560ee18433cec53db8e340caa3002edbd0f18f60
-
SHA256
3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079
-
SHA512
214fcbc66e3f60fba34cbf6b11bb9bcfcd0d7d91c9fd55beb4661f46f2e13477c8884c15caaebeb2a223b3564042df53967f7968fdb58b0d85e6155d15854620
-
SSDEEP
1536:qpSwdqgJ7zGYkSwKABCIvhZ9C9eO4F+NPouHj6Koa6Epm0SS+F8OJ6t+:wSwdqmGYkS/t6jaUS+
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exevatod.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vatod.exe -
Executes dropped EXE 1 IoCs
Processes:
vatod.exepid process 1356 vatod.exe -
Loads dropped DLL 2 IoCs
Processes:
3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exepid process 1736 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe 1736 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe -
Adds Run key to start application 2 TTPs 58 IoCs
Processes:
vatod.exe3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /q" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /f" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /k" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /z" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /i" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /b" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /k" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /a" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /w" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /g" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /l" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /v" vatod.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /d" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /s" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /x" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /y" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /h" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /r" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /f" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /t" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /o" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /e" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /l" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /p" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /i" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /m" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /d" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /n" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /x" vatod.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /q" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /u" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /o" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /j" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /u" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /t" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /c" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /a" vatod.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /m" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /w" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /v" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /g" vatod.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /r" 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /s" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /y" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /b" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /n" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /h" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /p" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /j" vatod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /c" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /e" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /z" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /r" vatod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vatod = "C:\\Users\\Admin\\vatod.exe /r" 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exevatod.exepid process 1736 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe 1356 vatod.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exevatod.exepid process 1736 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe 1356 vatod.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exedescription pid process target process PID 1736 wrote to memory of 1356 1736 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe vatod.exe PID 1736 wrote to memory of 1356 1736 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe vatod.exe PID 1736 wrote to memory of 1356 1736 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe vatod.exe PID 1736 wrote to memory of 1356 1736 3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe vatod.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe"C:\Users\Admin\AppData\Local\Temp\3a3d9ab42dacfaf4502a4715761d51b912a378916f9c22a1dca719eb11762079.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\vatod.exe"C:\Users\Admin\vatod.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\vatod.exeFilesize
164KB
MD52584ac749a6771c185d2fc6a85f4df35
SHA1e4cf8985851fcdc4dae1421e63245cb7e10fa365
SHA2566a9dd984526ebbac1de88341b9b737fbccd6ff4c0b61c7cfc320d09745e49d0e
SHA5125a4c7966bb00ce437339e2958c029bf2da0cb9c264a18f5bddb13d3f5c7779bb0cfd213e390dc16379e04e2053389516a4ac372145f85810f4fdd2ad85fca18d
-
C:\Users\Admin\vatod.exeFilesize
164KB
MD52584ac749a6771c185d2fc6a85f4df35
SHA1e4cf8985851fcdc4dae1421e63245cb7e10fa365
SHA2566a9dd984526ebbac1de88341b9b737fbccd6ff4c0b61c7cfc320d09745e49d0e
SHA5125a4c7966bb00ce437339e2958c029bf2da0cb9c264a18f5bddb13d3f5c7779bb0cfd213e390dc16379e04e2053389516a4ac372145f85810f4fdd2ad85fca18d
-
\Users\Admin\vatod.exeFilesize
164KB
MD52584ac749a6771c185d2fc6a85f4df35
SHA1e4cf8985851fcdc4dae1421e63245cb7e10fa365
SHA2566a9dd984526ebbac1de88341b9b737fbccd6ff4c0b61c7cfc320d09745e49d0e
SHA5125a4c7966bb00ce437339e2958c029bf2da0cb9c264a18f5bddb13d3f5c7779bb0cfd213e390dc16379e04e2053389516a4ac372145f85810f4fdd2ad85fca18d
-
\Users\Admin\vatod.exeFilesize
164KB
MD52584ac749a6771c185d2fc6a85f4df35
SHA1e4cf8985851fcdc4dae1421e63245cb7e10fa365
SHA2566a9dd984526ebbac1de88341b9b737fbccd6ff4c0b61c7cfc320d09745e49d0e
SHA5125a4c7966bb00ce437339e2958c029bf2da0cb9c264a18f5bddb13d3f5c7779bb0cfd213e390dc16379e04e2053389516a4ac372145f85810f4fdd2ad85fca18d
-
memory/1356-59-0x0000000000000000-mapping.dmp
-
memory/1736-56-0x00000000757B1000-0x00000000757B3000-memory.dmpFilesize
8KB