Analysis
-
max time kernel
161s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe
-
Size
180KB
-
MD5
25367120daee628dfc98cbf949aae3e0
-
SHA1
97603b86ed9a9b05714a867f247c49011f63473e
-
SHA256
900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4
-
SHA512
cf185dab17d4bef71da274bd40dc8f539f61a40a84941fb4b3adb5efcdabd2a4f9e84bd6027688ca05bafc2fd25d8ec701f80ff245dc66029e49fe196b12a11c
-
SSDEEP
3072:w5KAg3fsd23WKnvmb7/D26Nq/vJ+VFn8R4F7jIGs2YLtL9TKBd4GqeLQn/xE/M9D:NAgviKnvmb7/D26Nq/vJ+VFn8R4F7jIj
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" htrot.exe -
Executes dropped EXE 1 IoCs
pid Process 1824 htrot.exe -
Loads dropped DLL 2 IoCs
pid Process 2040 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe 2040 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /O" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /x" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /e" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /s" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /D" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /p" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /A" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /T" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /i" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /f" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /d" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /S" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /J" htrot.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /F" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /C" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /b" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /M" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /W" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /v" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /a" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /X" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /r" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /t" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /K" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /n" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /U" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /L" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /j" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /u" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /Y" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /g" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /E" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /R" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /Z" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /k" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /B" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /z" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /Q" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /q" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /y" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /G" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /w" htrot.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /h" 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /l" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /o" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /P" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /c" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /N" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /m" htrot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\htrot = "C:\\Users\\Admin\\htrot.exe /V" htrot.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe 1824 htrot.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2040 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe 1824 htrot.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1824 2040 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe 27 PID 2040 wrote to memory of 1824 2040 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe 27 PID 2040 wrote to memory of 1824 2040 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe 27 PID 2040 wrote to memory of 1824 2040 900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe"C:\Users\Admin\AppData\Local\Temp\900d09a99fca5800313fbee571a0321e116f4f2723fae955a5007e5f2a1fadd4.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\htrot.exe"C:\Users\Admin\htrot.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1824
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5786ec2a1b941408324fd8c6ade2e12ed
SHA1973ae80b4b88b7914a203f547040e6fe8f549165
SHA256ed81b692c0ae89477a1794dea545b3c6b28f4d7faf3e89f598bc4e0888f81e64
SHA512c76c760c31215c7e8dec8728a2b3e001a2ff565065f8313c706b427c8c683aff94595986ee63b25ab61cfd5c4b43525d57dd6084ba452977572dc746a0b83992
-
Filesize
180KB
MD5786ec2a1b941408324fd8c6ade2e12ed
SHA1973ae80b4b88b7914a203f547040e6fe8f549165
SHA256ed81b692c0ae89477a1794dea545b3c6b28f4d7faf3e89f598bc4e0888f81e64
SHA512c76c760c31215c7e8dec8728a2b3e001a2ff565065f8313c706b427c8c683aff94595986ee63b25ab61cfd5c4b43525d57dd6084ba452977572dc746a0b83992
-
Filesize
180KB
MD5786ec2a1b941408324fd8c6ade2e12ed
SHA1973ae80b4b88b7914a203f547040e6fe8f549165
SHA256ed81b692c0ae89477a1794dea545b3c6b28f4d7faf3e89f598bc4e0888f81e64
SHA512c76c760c31215c7e8dec8728a2b3e001a2ff565065f8313c706b427c8c683aff94595986ee63b25ab61cfd5c4b43525d57dd6084ba452977572dc746a0b83992
-
Filesize
180KB
MD5786ec2a1b941408324fd8c6ade2e12ed
SHA1973ae80b4b88b7914a203f547040e6fe8f549165
SHA256ed81b692c0ae89477a1794dea545b3c6b28f4d7faf3e89f598bc4e0888f81e64
SHA512c76c760c31215c7e8dec8728a2b3e001a2ff565065f8313c706b427c8c683aff94595986ee63b25ab61cfd5c4b43525d57dd6084ba452977572dc746a0b83992