5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d

General

Target

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
Size

264KB
MD5

486d59dbb37a6c13c4deb3bb11b514a0
SHA1

92780d7fabf2e5b616ed9f54882599aaee0af27d
SHA256

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d
SHA512

1ed2b980dc6a5ccc26e4f8e81d80aa1c859d175ec087a19c967ce4a144e9addffd45249f247d8f24841253bcd7e7b44ee300c51ebbed5c7e1e4423580a91caac
SSDEEP

6144:P3ziWP8SKE1OmsTluVPHOGiaE9pCvT0wFg:PZ8SKE1OmsTluVliaxbg

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exejoaumu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	joaumu.exe

Executes dropped EXE 1 IoCs

Processes:

joaumu.exe

pid process

1224 joaumu.exe

pid	process
1224	joaumu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

joaumu.exe5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /r"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /w"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /x"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /i"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /J"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /H"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /c"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /u"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /n"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /W"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /y"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /k"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /O"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /d"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /q"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /A"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /B"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /M"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /F"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /s"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /D"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /N"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /Q"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /Y"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /e"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /I"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /P"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /o"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /Z"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /V"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /g"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /h"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /t"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /M"	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /j"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /K"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /p"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /S"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /C"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /L"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /U"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /v"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /m"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /E"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /l"	joaumu.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /G"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /a"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /b"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /T"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /f"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /z"	joaumu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\joaumu = "C:\\Users\\Admin\\joaumu.exe /X"	joaumu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exejoaumu.exe

pid	process
4832	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
4832	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe
1224	joaumu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exejoaumu.exe

pid process

4832 5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
1224 joaumu.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe

description	pid	process	target process
PID 4832 wrote to memory of 1224	4832	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe	joaumu.exe
PID 4832 wrote to memory of 1224	4832	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe	joaumu.exe
PID 4832 wrote to memory of 1224	4832	5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe	joaumu.exe

C:\Users\Admin\AppData\Local\Temp\5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe
"C:\Users\Admin\AppData\Local\Temp\5a18ca133176712a2eaf24a600d2a53f494b56b151c290b084553a794fb8615d.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832

C:\Users\Admin\joaumu.exe
"C:\Users\Admin\joaumu.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\joaumu.exe

Filesize
264KB

MD5
3eaa60e9e2ff6e494e8ade6aa77e043c

SHA1
a32bd610e762aaf1f62021438a4a4370fa2785a6

SHA256
55c9b483b9fd0aab4003a9f4fca0b578c417f837b0f003b0f4485a14cb8caaa9

SHA512
817c4b235e03b53f1e68f6217e452d54d6568d6bd0f5fcb8c1530d3808bf6bed47387caae357eb91cd5cd814903756138b1779e706b8fc1115e2b0bc80672072

Download Submit
C:\Users\Admin\joaumu.exe

Filesize
264KB

MD5
3eaa60e9e2ff6e494e8ade6aa77e043c

SHA1
a32bd610e762aaf1f62021438a4a4370fa2785a6

SHA256
55c9b483b9fd0aab4003a9f4fca0b578c417f837b0f003b0f4485a14cb8caaa9

SHA512
817c4b235e03b53f1e68f6217e452d54d6568d6bd0f5fcb8c1530d3808bf6bed47387caae357eb91cd5cd814903756138b1779e706b8fc1115e2b0bc80672072

Download Submit
memory/1224-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads