Analysis
-
max time kernel
194s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:19
Static task
static1
Behavioral task
behavioral1
Sample
7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe
Resource
win10v2004-20221111-en
General
-
Target
7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe
-
Size
200KB
-
MD5
35e3611a32193bd0811ca468291bdc20
-
SHA1
89d4e5d7ade0318acf1c6c2926550a0f7138cb6f
-
SHA256
7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06
-
SHA512
9d669405d2897cc36bc094d4dcbfd64c8ae5ce11193ba0e4e3180098e9b9de5b21a2fb24ec1e0d5e7d98221927efbb9575f886832589860172d04ac2c296082f
-
SSDEEP
3072:h39SBZ8jprujIivwslnsn9+JuJbfoL2wVHTZhQTWVyc+LpfJQlKTQC4hk:19Shvwslnsn9+JuJbfoL2wVH9eI+NJWG
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exerijoz.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rijoz.exe -
Executes dropped EXE 1 IoCs
Processes:
rijoz.exepid process 4900 rijoz.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe -
Adds Run key to start application 2 TTPs 54 IoCs
Processes:
rijoz.exe7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /v" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /I" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /M" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /J" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /w" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /L" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /j" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /G" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /K" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /C" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /t" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /q" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /z" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /T" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /Z" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /P" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /U" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /o" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /c" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /N" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /X" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /O" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /s" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /l" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /B" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /g" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /H" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /d" rijoz.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /Q" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /a" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /E" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /y" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /p" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /F" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /x" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /W" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /k" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /A" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /u" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /r" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /D" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /Y" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /f" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /n" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /V" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /h" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /b" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /e" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /i" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /S" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /m" rijoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rijoz = "C:\\Users\\Admin\\rijoz.exe /n" 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ rijoz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exerijoz.exepid process 3972 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe 3972 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe 4900 rijoz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exerijoz.exepid process 3972 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe 4900 rijoz.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exedescription pid process target process PID 3972 wrote to memory of 4900 3972 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe rijoz.exe PID 3972 wrote to memory of 4900 3972 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe rijoz.exe PID 3972 wrote to memory of 4900 3972 7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe rijoz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe"C:\Users\Admin\AppData\Local\Temp\7feacb80f2589cfebb58bb6a16bd1894fce433c8ca6105506722280bfa30ed06.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\rijoz.exe"C:\Users\Admin\rijoz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD52758ce603a397d9a3f8864a3f34ac331
SHA1a2c337a0cc27108446110f65ea41633f2aadd2ff
SHA2561c1712a12772ca5b138f6515249aa704b0b801da31b23e6358b644df5acce1f0
SHA5122ec1109dd5f164c2e3d39bbabcac74504ef10260f6cf8520b85a6aae8402c460576ee19a65bfd85aeea020611109e501dee9f21d8784ed706a5ce98f7d82bcc0
-
Filesize
200KB
MD52758ce603a397d9a3f8864a3f34ac331
SHA1a2c337a0cc27108446110f65ea41633f2aadd2ff
SHA2561c1712a12772ca5b138f6515249aa704b0b801da31b23e6358b644df5acce1f0
SHA5122ec1109dd5f164c2e3d39bbabcac74504ef10260f6cf8520b85a6aae8402c460576ee19a65bfd85aeea020611109e501dee9f21d8784ed706a5ce98f7d82bcc0