Analysis
-
max time kernel
153s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:16
Static task
static1
Behavioral task
behavioral1
Sample
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe
Resource
win10v2004-20221111-en
General
-
Target
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe
-
Size
152KB
-
MD5
343fc5df63f9b219016e85558fde9130
-
SHA1
c29522ba836f8f6ce9f1a3dfdb32226adadab949
-
SHA256
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112
-
SHA512
d79ed6f8a209d1ecd478b2f6b3e0e3b6020b6ec6cfb248f884de5d76aff46914b8256b988ef8d09beedd83df5fb10dc63bd85512e0fba09f4c4b83fbd6d9848e
-
SSDEEP
3072:khUFgUtTQtKrueiygR4O6avJamofU4oQZiEpZ93:ZgUNQtKSMgR56avUmpW/
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exegoaade.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" goaade.exe -
Executes dropped EXE 1 IoCs
Processes:
goaade.exepid process 1532 goaade.exe -
Loads dropped DLL 2 IoCs
Processes:
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exepid process 1388 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe 1388 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe -
Adds Run key to start application 2 TTPs 49 IoCs
Processes:
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exegoaade.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /u" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /T" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /Y" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /l" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /L" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /F" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /V" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /I" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /a" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /d" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /X" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /p" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /P" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /O" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /q" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /j" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /i" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /U" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /E" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /o" goaade.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /s" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /n" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /K" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /H" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /J" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /g" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /k" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /W" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /B" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /M" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /e" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /b" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /c" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /O" 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /m" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /t" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /v" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /A" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /G" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /f" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /R" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /Z" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /S" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /r" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /D" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /C" goaade.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaade = "C:\\Users\\Admin\\goaade.exe /y" goaade.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exegoaade.exepid process 1388 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe 1532 goaade.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exegoaade.exepid process 1388 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe 1532 goaade.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exedescription pid process target process PID 1388 wrote to memory of 1532 1388 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe goaade.exe PID 1388 wrote to memory of 1532 1388 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe goaade.exe PID 1388 wrote to memory of 1532 1388 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe goaade.exe PID 1388 wrote to memory of 1532 1388 11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe goaade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe"C:\Users\Admin\AppData\Local\Temp\11140d50df472860a58b354dbac2445cbb5d121cb90a99c9af9d7350359a7112.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\goaade.exe"C:\Users\Admin\goaade.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\goaade.exeFilesize
152KB
MD5c86c3def5ba134bf498079a9d91afb6a
SHA1eddfa636d27b8d6beecbb5e4f126826b36481f5f
SHA25615c52fb8cc75fe004d250fd87939ee7cf85c8e7be0437cf6013724a2d8af10b2
SHA512d8ea548bf44e3c9a49a0c66c33ac29381e5f7606aa1b2831899296aaf39dc7c9244ebc960a67514664a3ebde4d69094bfd5973e10071bacee12d76648a87885d
-
C:\Users\Admin\goaade.exeFilesize
152KB
MD5c86c3def5ba134bf498079a9d91afb6a
SHA1eddfa636d27b8d6beecbb5e4f126826b36481f5f
SHA25615c52fb8cc75fe004d250fd87939ee7cf85c8e7be0437cf6013724a2d8af10b2
SHA512d8ea548bf44e3c9a49a0c66c33ac29381e5f7606aa1b2831899296aaf39dc7c9244ebc960a67514664a3ebde4d69094bfd5973e10071bacee12d76648a87885d
-
\Users\Admin\goaade.exeFilesize
152KB
MD5c86c3def5ba134bf498079a9d91afb6a
SHA1eddfa636d27b8d6beecbb5e4f126826b36481f5f
SHA25615c52fb8cc75fe004d250fd87939ee7cf85c8e7be0437cf6013724a2d8af10b2
SHA512d8ea548bf44e3c9a49a0c66c33ac29381e5f7606aa1b2831899296aaf39dc7c9244ebc960a67514664a3ebde4d69094bfd5973e10071bacee12d76648a87885d
-
\Users\Admin\goaade.exeFilesize
152KB
MD5c86c3def5ba134bf498079a9d91afb6a
SHA1eddfa636d27b8d6beecbb5e4f126826b36481f5f
SHA25615c52fb8cc75fe004d250fd87939ee7cf85c8e7be0437cf6013724a2d8af10b2
SHA512d8ea548bf44e3c9a49a0c66c33ac29381e5f7606aa1b2831899296aaf39dc7c9244ebc960a67514664a3ebde4d69094bfd5973e10071bacee12d76648a87885d
-
memory/1388-56-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1388-57-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/1388-58-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1388-66-0x00000000026A0000-0x00000000026CE000-memory.dmpFilesize
184KB
-
memory/1388-67-0x00000000026A0000-0x00000000026CE000-memory.dmpFilesize
184KB
-
memory/1532-61-0x0000000000000000-mapping.dmp
-
memory/1532-68-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1532-70-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB