Analysis

  • max time kernel
    208s
  • max time network
    209s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 00:23

General

  • Target

    a6f1ea90c5c15d0da98ee9a545f10ffcfe6327f22dd13e41d7ebb676a17fef14.exe

  • Size

    128KB

  • MD5

    515f63b6647a633f0e5246e6b1c06263

  • SHA1

    c183a64ee7e664f6e07fdf555f1130b03e6ac32c

  • SHA256

    a6f1ea90c5c15d0da98ee9a545f10ffcfe6327f22dd13e41d7ebb676a17fef14

  • SHA512

    ec3af034fcede6ebe71e90bca0de3b18d3d9bfaf598e082538a8ba34d8297b63f0b0c56c9f422f2d5ba9f8b29af3b073c2d6a5ad18e931dcc14a8f086d8d3808

  • SSDEEP

    1536:+Sk8uBI8OTta097n9Is9Flc4IE3IezPoVTTqtFhUpHnkHUS65BciumHnXtk:zk8uNOTs0BvHWAotqbvBmHS

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 58 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6f1ea90c5c15d0da98ee9a545f10ffcfe6327f22dd13e41d7ebb676a17fef14.exe
    "C:\Users\Admin\AppData\Local\Temp\a6f1ea90c5c15d0da98ee9a545f10ffcfe6327f22dd13e41d7ebb676a17fef14.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Users\Admin\niohu.exe
      "C:\Users\Admin\niohu.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4372

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\niohu.exe

    Filesize

    128KB

    MD5

    b026b4642eaf6329bb68a722d62b7e59

    SHA1

    6ebbe313c88d2104bff8ae3f66534ff875bbd021

    SHA256

    3297d22084af05726efe61d78735d279abee5c3131c6c22038a55be55a5029a5

    SHA512

    f6d0e21b598e9ac20eee5ebf2e523b6b39241a469642a124930b07fa09b8a1c98397e078cc469361b28e0778ce75015f3b3b563976265feabe4d7c3a5fa2c5bb

  • C:\Users\Admin\niohu.exe

    Filesize

    128KB

    MD5

    b026b4642eaf6329bb68a722d62b7e59

    SHA1

    6ebbe313c88d2104bff8ae3f66534ff875bbd021

    SHA256

    3297d22084af05726efe61d78735d279abee5c3131c6c22038a55be55a5029a5

    SHA512

    f6d0e21b598e9ac20eee5ebf2e523b6b39241a469642a124930b07fa09b8a1c98397e078cc469361b28e0778ce75015f3b3b563976265feabe4d7c3a5fa2c5bb

  • memory/4372-134-0x0000000000000000-mapping.dmp