Analysis
-
max time kernel
155s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:20
Static task
static1
Behavioral task
behavioral1
Sample
a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe
Resource
win10v2004-20220812-en
General
-
Target
a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe
-
Size
180KB
-
MD5
2ec852a71edc81327573b3ee3e4c3d9e
-
SHA1
2331672f9ebb1408a236ae65639c9d7eb5a520fc
-
SHA256
a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2
-
SHA512
8198c24ff0806d55d0f1b0ef3f5f26ebd4be4f8d76eda4b9ea438cf5bc7e6cf3b2750e3c27c819003b672aff7a2ad52fee79bcb363df2d791d60162f92acd85d
-
SSDEEP
3072:SIWGdYRLoeEdRos/eaqFnqWDb+uTyLDC6s5sSYqGlC6YViZj5HQXZmmJ0yCFioxj:9vcKPpm2lC6YViZj5HQXZmmJ0yCF9BxF
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exekouwof.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kouwof.exe -
Executes dropped EXE 1 IoCs
Processes:
kouwof.exepid process 3600 kouwof.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe -
Adds Run key to start application 2 TTPs 50 IoCs
Processes:
kouwof.exea6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /j" kouwof.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /f" a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /G" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /X" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /O" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /o" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /e" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /F" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /V" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /Z" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /c" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /N" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /t" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /B" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /W" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /y" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /s" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /J" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /l" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /a" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /p" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /P" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /r" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /w" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /D" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /f" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /I" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /A" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /d" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /x" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /T" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /Q" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /m" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /K" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /h" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /z" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /q" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /U" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /H" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /u" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /n" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /R" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /S" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /k" kouwof.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /M" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /v" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /b" kouwof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouwof = "C:\\Users\\Admin\\kouwof.exe /g" kouwof.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exekouwof.exepid process 704 a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe 704 a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe 3600 kouwof.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exekouwof.exepid process 704 a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe 3600 kouwof.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exedescription pid process target process PID 704 wrote to memory of 3600 704 a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe kouwof.exe PID 704 wrote to memory of 3600 704 a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe kouwof.exe PID 704 wrote to memory of 3600 704 a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe kouwof.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe"C:\Users\Admin\AppData\Local\Temp\a6a517cb8645b45b07cff88dfa462a8dcf9068c6832cf7d69d9dd9da8dcd8eb2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\kouwof.exe"C:\Users\Admin\kouwof.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\kouwof.exeFilesize
180KB
MD5f957876b44fe4a7751484063ce0cdc0a
SHA1d3b896f60bfcb77b40ca2ef4affcaed561647223
SHA2566ab7ae7fa3550f5e9954f99486671d10bbed99de829c017aa1543274891da4a0
SHA5127dcdc734c1d3896486c7d11371937d5b3411c873947b440fc13d28c2d7345dbff68c65c16a901ad202c4a0e5bf3644c6f2039bb6b6ae4371712124d93d3830be
-
C:\Users\Admin\kouwof.exeFilesize
180KB
MD5f957876b44fe4a7751484063ce0cdc0a
SHA1d3b896f60bfcb77b40ca2ef4affcaed561647223
SHA2566ab7ae7fa3550f5e9954f99486671d10bbed99de829c017aa1543274891da4a0
SHA5127dcdc734c1d3896486c7d11371937d5b3411c873947b440fc13d28c2d7345dbff68c65c16a901ad202c4a0e5bf3644c6f2039bb6b6ae4371712124d93d3830be
-
memory/3600-134-0x0000000000000000-mapping.dmp