Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:25
Static task
static1
Behavioral task
behavioral1
Sample
6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe
Resource
win10v2004-20220812-en
General
-
Target
6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe
-
Size
204KB
-
MD5
506208625ac93839c284cbfdfd05b9fe
-
SHA1
067ecb589cb5f75ee1c596cc9b1928f7bcca9f1d
-
SHA256
6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792
-
SHA512
b7b8282e0f71653033fa8364335094753f9fc8aa0a118bf7147a314246195008b914f76ba6cb609764be617aef2bd0b57d7a651cea70b93ef17e11a4906d1d70
-
SSDEEP
3072:+Vr+bRN2K57jQpI6d27GVV+FWl11oQB7t9X7aOQC:O+vF57jQS6dQGVVmWOQFL7aOQC
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exereoedo.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" reoedo.exe -
Executes dropped EXE 1 IoCs
Processes:
reoedo.exepid process 4916 reoedo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe -
Adds Run key to start application 2 TTPs 29 IoCs
Processes:
reoedo.exe6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /g" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /k" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /z" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /s" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /m" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /n" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /z" 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /h" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /y" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /o" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /j" reoedo.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /f" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /q" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /c" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /u" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /l" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /r" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /a" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /d" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /p" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /x" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /b" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /w" reoedo.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /v" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /i" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /e" reoedo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reoedo = "C:\\Users\\Admin\\reoedo.exe /t" reoedo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exereoedo.exepid process 1128 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe 1128 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe 4916 reoedo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exereoedo.exepid process 1128 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe 4916 reoedo.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exedescription pid process target process PID 1128 wrote to memory of 4916 1128 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe reoedo.exe PID 1128 wrote to memory of 4916 1128 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe reoedo.exe PID 1128 wrote to memory of 4916 1128 6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe reoedo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe"C:\Users\Admin\AppData\Local\Temp\6ab33f689a79095fcbc71df3a2f3d93387d8ac7bf5e7461e8c65aed2b6038792.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\reoedo.exe"C:\Users\Admin\reoedo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\reoedo.exeFilesize
204KB
MD5b490395a482f2d39b46b75ee4b64cea1
SHA148e0e2e8081285f00d4dd36cbcf429c234ef604e
SHA2568c3488dd463ef37b2cbacae2e3a3adf725cf99bbba05a9a5cb3ed2147cc7f66f
SHA512996268a227f7f6aa7edb27d440d9beba87257e706addc3a2958759002824dff3652f369ec66596d07db2fb6e62554de4fc0dc824a4bf8d6950e1f0a80dd08da9
-
C:\Users\Admin\reoedo.exeFilesize
204KB
MD5b490395a482f2d39b46b75ee4b64cea1
SHA148e0e2e8081285f00d4dd36cbcf429c234ef604e
SHA2568c3488dd463ef37b2cbacae2e3a3adf725cf99bbba05a9a5cb3ed2147cc7f66f
SHA512996268a227f7f6aa7edb27d440d9beba87257e706addc3a2958759002824dff3652f369ec66596d07db2fb6e62554de4fc0dc824a4bf8d6950e1f0a80dd08da9
-
memory/4916-134-0x0000000000000000-mapping.dmp