Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:28
Static task
static1
Behavioral task
behavioral1
Sample
59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe
Resource
win10v2004-20220812-en
General
-
Target
59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe
-
Size
44KB
-
MD5
0a57a263a4f31872061b7ee1badafa40
-
SHA1
215c84fd2b77564f2ce74572ad32e77e4b5aab0f
-
SHA256
59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b
-
SHA512
a4eb4cf6c2a336d640bdc19e014b7e313bb3d86d15c3b7148be8a3db0f31cd856607e637081e1baf6e5f2bc37952e88227706518ea82c2abdcf48c36ac7ff139
-
SSDEEP
768:oL/Hdy9Q5++YyXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:oHA9Hyj6S3T77
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
viuoqu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" viuoqu.exe -
Executes dropped EXE 1 IoCs
Processes:
viuoqu.exepid process 940 viuoqu.exe -
Loads dropped DLL 2 IoCs
Processes:
59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exepid process 368 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe 368 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
viuoqu.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ viuoqu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuoqu = "C:\\Users\\Admin\\viuoqu.exe" viuoqu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
viuoqu.exepid process 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe 940 viuoqu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exeviuoqu.exepid process 368 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe 940 viuoqu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exeviuoqu.exedescription pid process target process PID 368 wrote to memory of 940 368 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe viuoqu.exe PID 368 wrote to memory of 940 368 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe viuoqu.exe PID 368 wrote to memory of 940 368 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe viuoqu.exe PID 368 wrote to memory of 940 368 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe viuoqu.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe PID 940 wrote to memory of 368 940 viuoqu.exe 59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe"C:\Users\Admin\AppData\Local\Temp\59e4d0153397d7a1303ef90c6c508842c60a4e8f87297422471ac8f6872b965b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\viuoqu.exe"C:\Users\Admin\viuoqu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5f772f98f77b8c95d0358b51e32c2cd8e
SHA1bc27c725966bb1fcf4a6af9de20100613b7d7849
SHA256fa1694fd6a32cdb2656c308d29798770fcb77013dd5a929649e35155e10b1b41
SHA512a704471270f0d9928e910948cb4d0282bd35fd74207b39d624c7754037852d68d9aab0c5acda816863a1fdecb9c79d0b2cfa81615492d7c66b8f547fbad55d0c
-
Filesize
44KB
MD5f772f98f77b8c95d0358b51e32c2cd8e
SHA1bc27c725966bb1fcf4a6af9de20100613b7d7849
SHA256fa1694fd6a32cdb2656c308d29798770fcb77013dd5a929649e35155e10b1b41
SHA512a704471270f0d9928e910948cb4d0282bd35fd74207b39d624c7754037852d68d9aab0c5acda816863a1fdecb9c79d0b2cfa81615492d7c66b8f547fbad55d0c
-
Filesize
44KB
MD5f772f98f77b8c95d0358b51e32c2cd8e
SHA1bc27c725966bb1fcf4a6af9de20100613b7d7849
SHA256fa1694fd6a32cdb2656c308d29798770fcb77013dd5a929649e35155e10b1b41
SHA512a704471270f0d9928e910948cb4d0282bd35fd74207b39d624c7754037852d68d9aab0c5acda816863a1fdecb9c79d0b2cfa81615492d7c66b8f547fbad55d0c
-
Filesize
44KB
MD5f772f98f77b8c95d0358b51e32c2cd8e
SHA1bc27c725966bb1fcf4a6af9de20100613b7d7849
SHA256fa1694fd6a32cdb2656c308d29798770fcb77013dd5a929649e35155e10b1b41
SHA512a704471270f0d9928e910948cb4d0282bd35fd74207b39d624c7754037852d68d9aab0c5acda816863a1fdecb9c79d0b2cfa81615492d7c66b8f547fbad55d0c