40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea

General

Target

40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe
Size

288KB
MD5

28855f55d83f42ec01c3e91e6495b564
SHA1

b7c159c9e22478bc9af4ef8a7277fbf9a799774b
SHA256

40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea
SHA512

d1baae7dbfad941e83367e97cd90baed199eff9dd7c6041a9350adb801f026b956f69eb5ff54acbfd545162914af37b011176592667e885ec6c503fa09c074e3
SSDEEP

6144:t1BQc0f7XP+g3AGJpWVzuFnmI8nQOsPVKnvmb7/D26Mbj/R8SUHAgOTTMEtBTTln:J27/XvLWpuFWnQOsPVKnvmb7/D26MHUa

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

hiauja.exe40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hiauja.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe

Executes dropped EXE 1 IoCs

Processes:

hiauja.exe

pid process

2044 hiauja.exe

pid	process
2044	hiauja.exe

Loads dropped DLL 2 IoCs

Processes:

40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe

pid	process
1036	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe
1036	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hiauja.exe40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /z"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /j"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /u"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /I"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /K"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /q"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /X"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /t"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /m"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /W"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /P"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /w"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /J"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /h"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /U"	hiauja.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /o"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /H"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /b"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /l"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /V"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /E"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /C"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /A"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /x"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /Y"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /p"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /e"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /G"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /M"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /S"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /d"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /R"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /k"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /Q"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /B"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /Z"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /g"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /y"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /a"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /c"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /N"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /O"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /D"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /r"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /W"	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /n"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /s"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /i"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /T"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /v"	hiauja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiauja = "C:\\Users\\Admin\\hiauja.exe /F"	hiauja.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exehiauja.exe

pid	process
1036	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe
2044	hiauja.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exehiauja.exe

pid process

1036 40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe
2044 hiauja.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe

description	pid	process	target process
PID 1036 wrote to memory of 2044	1036	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe	hiauja.exe
PID 1036 wrote to memory of 2044	1036	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe	hiauja.exe
PID 1036 wrote to memory of 2044	1036	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe	hiauja.exe
PID 1036 wrote to memory of 2044	1036	40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe	hiauja.exe

C:\Users\Admin\AppData\Local\Temp\40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe
"C:\Users\Admin\AppData\Local\Temp\40f9c8934dc1f2c11f65e7c129ab4ee22d5153a50b61ebd7d6a102df7a5e96ea.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\hiauja.exe
  "C:\Users\Admin\hiauja.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\hiauja.exe

Filesize
288KB

MD5
4e9464bbb80b5d58c96e31dfe9bc8997

SHA1
c09b02161d37f83be724b8726782adb1f2b3e6bc

SHA256
95f752104aa201f7079d4da885c7bb87091a71c3010942f636a589f285ddf6f9

SHA512
66bfe0e8af5b37379ee84c5f86f3ccd8888c92c6d8038e9963729a7205036a341278a5aea4e8034d7043ea630cfbb4c6a49f50b1dd15b4385b68a28b69b28873

Download Submit
C:\Users\Admin\hiauja.exe

Filesize
288KB

MD5
4e9464bbb80b5d58c96e31dfe9bc8997

SHA1
c09b02161d37f83be724b8726782adb1f2b3e6bc

SHA256
95f752104aa201f7079d4da885c7bb87091a71c3010942f636a589f285ddf6f9

SHA512
66bfe0e8af5b37379ee84c5f86f3ccd8888c92c6d8038e9963729a7205036a341278a5aea4e8034d7043ea630cfbb4c6a49f50b1dd15b4385b68a28b69b28873

Download Submit
\Users\Admin\hiauja.exe

Filesize
288KB

MD5
4e9464bbb80b5d58c96e31dfe9bc8997

SHA1
c09b02161d37f83be724b8726782adb1f2b3e6bc

SHA256
95f752104aa201f7079d4da885c7bb87091a71c3010942f636a589f285ddf6f9

SHA512
66bfe0e8af5b37379ee84c5f86f3ccd8888c92c6d8038e9963729a7205036a341278a5aea4e8034d7043ea630cfbb4c6a49f50b1dd15b4385b68a28b69b28873

Download Submit
\Users\Admin\hiauja.exe

Filesize
288KB

MD5
4e9464bbb80b5d58c96e31dfe9bc8997

SHA1
c09b02161d37f83be724b8726782adb1f2b3e6bc

SHA256
95f752104aa201f7079d4da885c7bb87091a71c3010942f636a589f285ddf6f9

SHA512
66bfe0e8af5b37379ee84c5f86f3ccd8888c92c6d8038e9963729a7205036a341278a5aea4e8034d7043ea630cfbb4c6a49f50b1dd15b4385b68a28b69b28873

Download Submit
memory/1036-56-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1036-57-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1036-65-0x0000000002BC0000-0x0000000002C19000-memory.dmp

Filesize
356KB

Download
memory/1036-66-0x0000000002BC0000-0x0000000002C19000-memory.dmp

Filesize
356KB

Download
memory/1036-69-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2044-60-0x0000000000000000-mapping.dmp

Download
memory/2044-67-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2044-70-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads