bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb

General

Target

bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe
Size

216KB
MD5

2b109e310349ac6476fac279239c53e0
SHA1

c44a85b0d9c78035c77c6e2bf90e17dd3eba8f6a
SHA256

bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb
SHA512

2f33954ae7e563f55730a05ba07e30e44d7dcec40b27a6352182376173854a27870dd8879ba35f20fb91381e90c44e2f42ae1a4d4d14b16650635014707e67e4
SSDEEP

3072:mFvdlkZboHFGFooobAqzNOEbOKZbtpGPsLxf:mFvzNPseNmKJtpLf

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exegoeay.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	goeay.exe

Executes dropped EXE 1 IoCs

Processes:

goeay.exe

pid process

1772 goeay.exe

pid	process
1772	goeay.exe

Loads dropped DLL 2 IoCs

Processes:

bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe

pid	process
1980	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe
1980	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

goeay.exebff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /W"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /G"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /M"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /V"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /d"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /J"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /g"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /O"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /B"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /L"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /n"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /l"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /h"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /x"	goeay.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /C"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /y"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /k"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /o"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /s"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /j"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /z"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /D"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /T"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /R"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /t"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /Z"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /v"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /f"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /I"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /N"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /m"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /F"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /Q"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /p"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /b"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /w"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /a"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /P"	goeay.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /X"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /A"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /H"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /i"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /E"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /q"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /U"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /q"	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /u"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /Y"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /r"	goeay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeay = "C:\\Users\\Admin\\goeay.exe /K"	goeay.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exegoeay.exe

pid	process
1980	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe
1772	goeay.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exegoeay.exe

pid process

1980 bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe
1772 goeay.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe

description	pid	process	target process
PID 1980 wrote to memory of 1772	1980	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe	goeay.exe
PID 1980 wrote to memory of 1772	1980	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe	goeay.exe
PID 1980 wrote to memory of 1772	1980	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe	goeay.exe
PID 1980 wrote to memory of 1772	1980	bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe	goeay.exe

C:\Users\Admin\AppData\Local\Temp\bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe
"C:\Users\Admin\AppData\Local\Temp\bff2bf493325119f9a575f1b1917ee01679c48b4991ca9356c33e1dccb0631bb.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980

C:\Users\Admin\goeay.exe
"C:\Users\Admin\goeay.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\goeay.exe
Filesize
216KB

MD5
47cad77a10d81110d2deb3cf6a6bf713

SHA1
a7068534bf0a20bd239c10f0accd91a8ef9d825f

SHA256
2b6cb87efea5864f2c7256c24658f3dcebe9787c60f2dd54e94ec6ee93011970

SHA512
ce6e7cea23e845f67a567556cea14159163b0360e8afae01c7e0bb813d0ccb5052d0003c154b19a61bef53c22ee01423e338c6fd4bf4000b000219396870efe7

Download Submit
C:\Users\Admin\goeay.exe
Filesize
216KB

MD5
47cad77a10d81110d2deb3cf6a6bf713

SHA1
a7068534bf0a20bd239c10f0accd91a8ef9d825f

SHA256
2b6cb87efea5864f2c7256c24658f3dcebe9787c60f2dd54e94ec6ee93011970

SHA512
ce6e7cea23e845f67a567556cea14159163b0360e8afae01c7e0bb813d0ccb5052d0003c154b19a61bef53c22ee01423e338c6fd4bf4000b000219396870efe7

Download Submit
\Users\Admin\goeay.exe
Filesize
216KB

MD5
47cad77a10d81110d2deb3cf6a6bf713

SHA1
a7068534bf0a20bd239c10f0accd91a8ef9d825f

SHA256
2b6cb87efea5864f2c7256c24658f3dcebe9787c60f2dd54e94ec6ee93011970

SHA512
ce6e7cea23e845f67a567556cea14159163b0360e8afae01c7e0bb813d0ccb5052d0003c154b19a61bef53c22ee01423e338c6fd4bf4000b000219396870efe7

Download Submit
\Users\Admin\goeay.exe
Filesize
216KB

MD5
47cad77a10d81110d2deb3cf6a6bf713

SHA1
a7068534bf0a20bd239c10f0accd91a8ef9d825f

SHA256
2b6cb87efea5864f2c7256c24658f3dcebe9787c60f2dd54e94ec6ee93011970

SHA512
ce6e7cea23e845f67a567556cea14159163b0360e8afae01c7e0bb813d0ccb5052d0003c154b19a61bef53c22ee01423e338c6fd4bf4000b000219396870efe7

Download Submit
memory/1772-59-0x0000000000000000-mapping.dmp

Download
memory/1980-56-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads