c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03

General

Target

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
Size

192KB
MD5

434e2a39f41f81234fc0dac306281235
SHA1

0ecca3085bad96894cf95d27bfd532e98d98cd07
SHA256

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03
SHA512

ca78a7dedacd8c41452ce416ac2cb73479cae5a39892d4c3970cdd3278d8618cbf7f4b06ae7007dac4c51fbe461db93a53a62660a81f1540772329c3700b8e44
SSDEEP

3072:6wBJ2pHh+RH5UL1iUG3KgKLKRKSdNIVqR5VxerayK/fObT/bGicFgvXb6jGJBXX:6wBJKHcRZSgKgKLKRKSdNIVqRTxEpK/u

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exehuakea.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	huakea.exe

Executes dropped EXE 1 IoCs

Processes:

huakea.exe

pid process

1848 huakea.exe

pid	process
1848	huakea.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

huakea.exec0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /A"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /q"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /k"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /v"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /a"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /t"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /F"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /z"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /C"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /g"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /e"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /x"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /p"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /T"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /L"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /l"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /c"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /N"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /P"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /Z"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /O"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /X"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /Y"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /u"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /y"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /b"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /B"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /S"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /f"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /G"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /U"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /J"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /j"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /w"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /m"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /r"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /s"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /Q"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /n"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /V"	huakea.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /D"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /R"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /i"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /W"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /K"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /o"	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /M"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /d"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /I"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /H"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /h"	huakea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huakea = "C:\\Users\\Admin\\huakea.exe /E"	huakea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exehuakea.exe

pid	process
768	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
768	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe
1848	huakea.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exehuakea.exe

pid process

768 c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
1848 huakea.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe

description	pid	process	target process
PID 768 wrote to memory of 1848	768	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe	huakea.exe
PID 768 wrote to memory of 1848	768	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe	huakea.exe
PID 768 wrote to memory of 1848	768	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe	huakea.exe

C:\Users\Admin\AppData\Local\Temp\c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
"C:\Users\Admin\AppData\Local\Temp\c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768

C:\Users\Admin\huakea.exe
"C:\Users\Admin\huakea.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\huakea.exe
Filesize
192KB

MD5
1667016773069bdacbe86728a12a3ea8

SHA1
5b335502d0ff8325cf9e453d1168d5eb5a128c82

SHA256
61d53e9a08e70dae7a757952d5cb73f93dca2aa3f06fee4a48389f9e7264f506

SHA512
5091c962ef3111fa73dd66447d0a1709605bd16a35635e1a091756591212cda53794b70b3bc11df0e718fb735241f1f04e0c1d32b664abffb05e2a8e24baf46b

Download Submit
C:\Users\Admin\huakea.exe
Filesize
192KB

MD5
1667016773069bdacbe86728a12a3ea8

SHA1
5b335502d0ff8325cf9e453d1168d5eb5a128c82

SHA256
61d53e9a08e70dae7a757952d5cb73f93dca2aa3f06fee4a48389f9e7264f506

SHA512
5091c962ef3111fa73dd66447d0a1709605bd16a35635e1a091756591212cda53794b70b3bc11df0e718fb735241f1f04e0c1d32b664abffb05e2a8e24baf46b

Download Submit
memory/1848-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads