Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:20
Static task
static1
Behavioral task
behavioral1
Sample
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe
Resource
win10v2004-20221111-en
General
-
Target
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe
-
Size
172KB
-
MD5
36b95047d576b743fc23c2754b237ac0
-
SHA1
8bf4e4d6463494c6a3d85a12c282a60334b24ff7
-
SHA256
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d
-
SHA512
eeebbe689e7ab8dbb5979ec332ca235a2776abe283d4d61b5ec5d5e57c11da1c3269cdc740b3ce1fdc19a15a693aa6591033bfcf43cef8de24087cae78286a4f
-
SSDEEP
3072:VxjQXp5YHeNh1nm9JuKnvmb7/D26tvJc56bzfCKpbVuugHvmDQiBuAZdQN:7jQ7LNh1wMKnvmb7/D26tBc5KDCKpBuv
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exepouwib.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pouwib.exe -
Executes dropped EXE 1 IoCs
Processes:
pouwib.exepid process 1848 pouwib.exe -
Loads dropped DLL 2 IoCs
Processes:
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exepid process 1688 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe 1688 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe -
Adds Run key to start application 2 TTPs 51 IoCs
Processes:
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exepouwib.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /x" 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /G" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /I" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /U" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /D" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /m" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /d" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /g" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /O" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /R" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /f" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /C" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /F" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /e" pouwib.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /z" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /l" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /M" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /y" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /t" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /o" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /W" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /i" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /p" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /E" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /w" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /x" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /Q" pouwib.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /q" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /X" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /T" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /b" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /Y" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /S" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /v" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /H" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /h" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /P" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /c" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /B" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /u" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /j" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /A" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /L" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /V" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /r" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /k" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /n" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /J" pouwib.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouwib = "C:\\Users\\Admin\\pouwib.exe /s" pouwib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exepouwib.exepid process 1688 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe 1848 pouwib.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exepouwib.exepid process 1688 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe 1848 pouwib.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exedescription pid process target process PID 1688 wrote to memory of 1848 1688 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe pouwib.exe PID 1688 wrote to memory of 1848 1688 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe pouwib.exe PID 1688 wrote to memory of 1848 1688 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe pouwib.exe PID 1688 wrote to memory of 1848 1688 5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe pouwib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe"C:\Users\Admin\AppData\Local\Temp\5fe872a310251c03bd908e944a2d84ccb2cd5bb9593e34b2b71add05d8793d3d.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\pouwib.exe"C:\Users\Admin\pouwib.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\pouwib.exeFilesize
172KB
MD57766b9dfff8b81d4d5986e0990ba5df8
SHA1699a5937be46af867c06ef56fa0a74b368b09285
SHA25615cae6f13c9bb6ad9492e94821a758bcd1be5b37c3f5a3db869a830f13f69753
SHA512bdfc0739bacc8b07699d6839a85399bacaba9152c17ed1284e47dd3d5f3b5e8919837ed1d55d7d4f405ac64aeb54a0c067710edc62309ccd6a318d39e9d52751
-
C:\Users\Admin\pouwib.exeFilesize
172KB
MD57766b9dfff8b81d4d5986e0990ba5df8
SHA1699a5937be46af867c06ef56fa0a74b368b09285
SHA25615cae6f13c9bb6ad9492e94821a758bcd1be5b37c3f5a3db869a830f13f69753
SHA512bdfc0739bacc8b07699d6839a85399bacaba9152c17ed1284e47dd3d5f3b5e8919837ed1d55d7d4f405ac64aeb54a0c067710edc62309ccd6a318d39e9d52751
-
\Users\Admin\pouwib.exeFilesize
172KB
MD57766b9dfff8b81d4d5986e0990ba5df8
SHA1699a5937be46af867c06ef56fa0a74b368b09285
SHA25615cae6f13c9bb6ad9492e94821a758bcd1be5b37c3f5a3db869a830f13f69753
SHA512bdfc0739bacc8b07699d6839a85399bacaba9152c17ed1284e47dd3d5f3b5e8919837ed1d55d7d4f405ac64aeb54a0c067710edc62309ccd6a318d39e9d52751
-
\Users\Admin\pouwib.exeFilesize
172KB
MD57766b9dfff8b81d4d5986e0990ba5df8
SHA1699a5937be46af867c06ef56fa0a74b368b09285
SHA25615cae6f13c9bb6ad9492e94821a758bcd1be5b37c3f5a3db869a830f13f69753
SHA512bdfc0739bacc8b07699d6839a85399bacaba9152c17ed1284e47dd3d5f3b5e8919837ed1d55d7d4f405ac64aeb54a0c067710edc62309ccd6a318d39e9d52751
-
memory/1688-56-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB
-
memory/1848-59-0x0000000000000000-mapping.dmp