eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892

General

Target

eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe
Size

224KB
MD5

03371be526b8987b6185d22840f73891
SHA1

5226c3d9b23b0280fb718c777581fa3a461138ab
SHA256

eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892
SHA512

6b3dfec52c19ca8a56cb2d663d30c45992f9cabea0c7dc8c1f7a74b9fbca8cb6852dd92a1228efca3445da00830040502264dffb17baeba8158b37045cd25a32
SSDEEP

3072:1XyqNsMoBuVjCZVpl2mclbj4Uvx+8ysNOu+2eRcKksU61JkkX39RLrw4ySKUbaxb:MqN5VjKp4LnbmlrZW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exevoapoi.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	voapoi.exe

Executes dropped EXE 1 IoCs

Processes:

voapoi.exe

pid process

1476 voapoi.exe

pid	process
1476	voapoi.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exevoapoi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /a"	eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /r"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /t"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /s"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /y"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /n"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /e"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /b"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /k"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /g"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /h"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /i"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /c"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /x"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /q"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /o"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /z"	voapoi.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /a"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /j"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /w"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /u"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /f"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /d"	voapoi.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /m"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /l"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /v"	voapoi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voapoi = "C:\\Users\\Admin\\voapoi.exe /p"	voapoi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exevoapoi.exe

pid	process
4088	eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe
4088	eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe
1476	voapoi.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exevoapoi.exe

pid process

4088 eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe
1476 voapoi.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe

description	pid	process	target process
PID 4088 wrote to memory of 1476	4088	eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe	voapoi.exe
PID 4088 wrote to memory of 1476	4088	eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe	voapoi.exe
PID 4088 wrote to memory of 1476	4088	eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe	voapoi.exe

C:\Users\Admin\AppData\Local\Temp\eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe
"C:\Users\Admin\AppData\Local\Temp\eed2e9bffb3a85b80ccf9dab6e18ed17759f9dc3388a5819ab8e909c96553892.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Admin\voapoi.exe
"C:\Users\Admin\voapoi.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\voapoi.exe

Filesize
224KB

MD5
3102c152c43c660e8172dbc9f6ef8fbf

SHA1
6d7e879031ec0b69bd4c9c200a7d9d1e3ee9dc3e

SHA256
64be84a5b7a8779618169d1db3d97f9f28e61399ce1b1976d87808afabf1d0f7

SHA512
c63ce5e2d73d84908bba3f6236450fcca79354623ad63e75e5738114f4fe45020d82441dea8834e2601dd4bed1f854dd4e93fcfd659d555a623fa2306db4373b

Download Submit
C:\Users\Admin\voapoi.exe

Filesize
224KB

MD5
3102c152c43c660e8172dbc9f6ef8fbf

SHA1
6d7e879031ec0b69bd4c9c200a7d9d1e3ee9dc3e

SHA256
64be84a5b7a8779618169d1db3d97f9f28e61399ce1b1976d87808afabf1d0f7

SHA512
c63ce5e2d73d84908bba3f6236450fcca79354623ad63e75e5738114f4fe45020d82441dea8834e2601dd4bed1f854dd4e93fcfd659d555a623fa2306db4373b

Download Submit
memory/1476-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads