1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9

General

Target

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
Size

252KB
MD5

29b3352042d3cbf20bcb23361f771930
SHA1

fc8621ea3dffded92acf59165efb17a72f37735d
SHA256

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9
SHA512

c766b93ec62bf5a44609330f165bf631a76469b3b7a3b3b4efbce600d61b91fd4f96535d8a141afe30924ee0e48a2512eb8a4b3c7e074c3ac4ad07ad03093d3e
SSDEEP

6144:8X7CGWUsbNZeoq6AvFPpWlyfeWgdx1XxcNoX+poNd8m3RZWuAzgGk:8RWUsbbeoq6AFpWlyfeWgdx1Xxq4+pob

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exepuisaj.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	puisaj.exe

Executes dropped EXE 1 IoCs

Processes:

puisaj.exe

pid process

1712 puisaj.exe

pid	process
1712	puisaj.exe

Loads dropped DLL 2 IoCs

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe

pid	process
1740	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
1740	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe

Adds Run key to start application 2 TTPs 48 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

puisaj.exe1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /D"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /c"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /q"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /t"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /M"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /Y"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /a"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /h"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /U"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /d"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /L"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /C"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /i"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /o"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /Z"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /n"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /s"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /l"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /b"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /W"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /y"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /A"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /w"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /e"	puisaj.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /r"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /P"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /x"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /X"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /H"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /V"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /f"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /p"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /I"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /S"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /m"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /v"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /k"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /G"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /s"	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /O"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /u"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /R"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /B"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /j"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /E"	puisaj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\puisaj = "C:\\Users\\Admin\\puisaj.exe /g"	puisaj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exepuisaj.exe

pid	process
1740	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe
1712	puisaj.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exepuisaj.exe

pid process

1740 1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
1712 puisaj.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe

description	pid	process	target process
PID 1740 wrote to memory of 1712	1740	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe	puisaj.exe
PID 1740 wrote to memory of 1712	1740	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe	puisaj.exe
PID 1740 wrote to memory of 1712	1740	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe	puisaj.exe
PID 1740 wrote to memory of 1712	1740	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe	puisaj.exe

C:\Users\Admin\AppData\Local\Temp\1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
"C:\Users\Admin\AppData\Local\Temp\1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\puisaj.exe
  "C:\Users\Admin\puisaj.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\puisaj.exe

Filesize
252KB

MD5
0b520fc493908f72d2a13125674fda51

SHA1
7220b9d2ce8e735f6e1029a8d7d3fb236af990d0

SHA256
8cd80aacce3746dc07fed5cef2f2d12fc3857694c28d6cbbed9a8e672d40835a

SHA512
2d2e934790e129650e13790e58d66030df821f1ea8dfdcf672e90a0b071fc2f6d8690a7fc963af7a4d897095377b4ffe8d2d690abe240ec773b626332a159bcf

Download Submit
C:\Users\Admin\puisaj.exe

Filesize
252KB

MD5
0b520fc493908f72d2a13125674fda51

SHA1
7220b9d2ce8e735f6e1029a8d7d3fb236af990d0

SHA256
8cd80aacce3746dc07fed5cef2f2d12fc3857694c28d6cbbed9a8e672d40835a

SHA512
2d2e934790e129650e13790e58d66030df821f1ea8dfdcf672e90a0b071fc2f6d8690a7fc963af7a4d897095377b4ffe8d2d690abe240ec773b626332a159bcf

Download Submit
\Users\Admin\puisaj.exe

Filesize
252KB

MD5
0b520fc493908f72d2a13125674fda51

SHA1
7220b9d2ce8e735f6e1029a8d7d3fb236af990d0

SHA256
8cd80aacce3746dc07fed5cef2f2d12fc3857694c28d6cbbed9a8e672d40835a

SHA512
2d2e934790e129650e13790e58d66030df821f1ea8dfdcf672e90a0b071fc2f6d8690a7fc963af7a4d897095377b4ffe8d2d690abe240ec773b626332a159bcf

Download Submit
\Users\Admin\puisaj.exe

Filesize
252KB

MD5
0b520fc493908f72d2a13125674fda51

SHA1
7220b9d2ce8e735f6e1029a8d7d3fb236af990d0

SHA256
8cd80aacce3746dc07fed5cef2f2d12fc3857694c28d6cbbed9a8e672d40835a

SHA512
2d2e934790e129650e13790e58d66030df821f1ea8dfdcf672e90a0b071fc2f6d8690a7fc963af7a4d897095377b4ffe8d2d690abe240ec773b626332a159bcf

Download Submit
memory/1712-59-0x0000000000000000-mapping.dmp

Download
memory/1740-56-0x0000000076301000-0x0000000076303000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads