Analysis
-
max time kernel
59s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:24
Static task
static1
Behavioral task
behavioral1
Sample
adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe
Resource
win10v2004-20220812-en
General
-
Target
adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe
-
Size
132KB
-
MD5
32f1fd9c985a2fde6c6b3610c86b0540
-
SHA1
d935dcb0ae7feb7fd73e7a5b38ca2fd3281581a3
-
SHA256
adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46
-
SHA512
790725982c2e100313b372e0db21690c5571884d18628e2e167057385b290da4ed23df013046d9bb370be6f7825903c6dbe34a19ee67980a17a72aba5dc5d6a9
-
SSDEEP
1536:pjmgYD4KnMnzzMcVinEGKbfJGuGt0EsZnFF+t+:Vm1D/Mnz4cVinEGiJEaFFe+
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exechmoim.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" chmoim.exe -
Executes dropped EXE 1 IoCs
Processes:
chmoim.exepid process 5064 chmoim.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe -
Adds Run key to start application 2 TTPs 55 IoCs
Processes:
chmoim.exeadf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /i" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /t" chmoim.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /r" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /z" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /c" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /m" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /z" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /e" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /m" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /d" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /h" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /p" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /d" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /t" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /n" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /a" chmoim.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /f" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /f" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /k" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /l" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /k" adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /v" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /y" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /q" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /r" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /w" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /j" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /j" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /k" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /c" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /e" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /j" adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /y" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /p" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /h" chmoim.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /s" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /u" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /l" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /b" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /q" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /u" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /b" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /v" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /o" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /i" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /g" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /x" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /o" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /g" chmoim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /n" chmoim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chmoim = "C:\\Users\\Admin\\chmoim.exe /a" chmoim.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exechmoim.exepid process 2284 adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe 2284 adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe 5064 chmoim.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exechmoim.exepid process 2284 adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe 5064 chmoim.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exedescription pid process target process PID 2284 wrote to memory of 5064 2284 adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe chmoim.exe PID 2284 wrote to memory of 5064 2284 adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe chmoim.exe PID 2284 wrote to memory of 5064 2284 adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe chmoim.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe"C:\Users\Admin\AppData\Local\Temp\adf818e9b84af87bc360cc2567e7ad394b037cd24ef2b94761ff75021af89b46.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\chmoim.exe"C:\Users\Admin\chmoim.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\chmoim.exeFilesize
132KB
MD52bbac105fee1da6db42b74bee0e386ee
SHA13fa7d3caf3ec75c09a6143e159120a51349677be
SHA256fa675b527878f55d8efe23f2942ef7538db15aeffa8e9d5926701edbff66c2a6
SHA512a5065ffcf6860546a60b489f335b260c3e4d4be20990823745dda351fe4afe3fe67cb9510803eec8f8442a05e746ff742a788c5b8e5b50f5eeeaa5d6be2a7e61
-
C:\Users\Admin\chmoim.exeFilesize
132KB
MD52bbac105fee1da6db42b74bee0e386ee
SHA13fa7d3caf3ec75c09a6143e159120a51349677be
SHA256fa675b527878f55d8efe23f2942ef7538db15aeffa8e9d5926701edbff66c2a6
SHA512a5065ffcf6860546a60b489f335b260c3e4d4be20990823745dda351fe4afe3fe67cb9510803eec8f8442a05e746ff742a788c5b8e5b50f5eeeaa5d6be2a7e61
-
memory/2284-132-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2284-135-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5064-136-0x0000000000000000-mapping.dmp
-
memory/5064-141-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5064-142-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB