a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8

General

Target

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
Size

84KB
MD5

3614775c4d2b7504d608360d5b4db290
SHA1

5d7dcc6f6c318ae23ae9cd19665907fa8ae8c696
SHA256

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8
SHA512

b3b6d1706f7675000b53a169effa5828e43514f939a3a2957e6e93ec29fd04aaee865636bb3988fe06a641be113c46ef1296b21bc3b213d84b767919a09e4391
SSDEEP

768:DTbYNscGYzZ2i+BJd/bI0/F/NstMlwQTOxelNmw5jRnDU5b:DTWG6H+n5IUJxdlNmKjRqb

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

nuisii.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nuisii.exe

Executes dropped EXE 1 IoCs

Processes:

nuisii.exe

pid process

964 nuisii.exe

pid	process
964	nuisii.exe

Loads dropped DLL 2 IoCs

Processes:

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe

pid	process
1192	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
1192	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

nuisii.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nuisii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuisii = "C:\\Users\\Admin\\nuisii.exe"	nuisii.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

nuisii.exe

pid process

964 nuisii.exe
964 nuisii.exe
964 nuisii.exe
964 nuisii.exe
964 nuisii.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exenuisii.exe

pid process

1192 a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
964 nuisii.exe

pid	process
964	nuisii.exe
964	nuisii.exe
964	nuisii.exe
964	nuisii.exe
964	nuisii.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exenuisii.exe

description	pid	process	target process
PID 1192 wrote to memory of 964	1192	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe	nuisii.exe
PID 1192 wrote to memory of 964	1192	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe	nuisii.exe
PID 1192 wrote to memory of 964	1192	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe	nuisii.exe
PID 1192 wrote to memory of 964	1192	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe	nuisii.exe
PID 964 wrote to memory of 1192	964	nuisii.exe	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
PID 964 wrote to memory of 1192	964	nuisii.exe	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
PID 964 wrote to memory of 1192	964	nuisii.exe	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
PID 964 wrote to memory of 1192	964	nuisii.exe	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
PID 964 wrote to memory of 1192	964	nuisii.exe	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
PID 964 wrote to memory of 1192	964	nuisii.exe	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
PID 964 wrote to memory of 1192	964	nuisii.exe	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
PID 964 wrote to memory of 1192	964	nuisii.exe	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe

C:\Users\Admin\AppData\Local\Temp\a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
"C:\Users\Admin\AppData\Local\Temp\a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\nuisii.exe
"C:\Users\Admin\nuisii.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\nuisii.exe

Filesize
84KB

MD5
eba0f4401196ce3108436fd89e443b3b

SHA1
bd71dfe26bcb938068c2f01aa58c0b8b87cf5848

SHA256
4869832ebb02b0807d217cc601aa13dc5ffa15b10c22818fa91d92e0c4e239c3

SHA512
638ec50615279dc084a620af27f7548a04669eaad15cb5c9dbb7db4b826d23b9f6f14b5eef423b4d084f29651ed6bce89b4bd651416bdf154f1589c769f1b96b

Download Submit
C:\Users\Admin\nuisii.exe

Filesize
84KB

MD5
eba0f4401196ce3108436fd89e443b3b

SHA1
bd71dfe26bcb938068c2f01aa58c0b8b87cf5848

SHA256
4869832ebb02b0807d217cc601aa13dc5ffa15b10c22818fa91d92e0c4e239c3

SHA512
638ec50615279dc084a620af27f7548a04669eaad15cb5c9dbb7db4b826d23b9f6f14b5eef423b4d084f29651ed6bce89b4bd651416bdf154f1589c769f1b96b

Download Submit
\Users\Admin\nuisii.exe

Filesize
84KB

MD5
eba0f4401196ce3108436fd89e443b3b

SHA1
bd71dfe26bcb938068c2f01aa58c0b8b87cf5848

SHA256
4869832ebb02b0807d217cc601aa13dc5ffa15b10c22818fa91d92e0c4e239c3

SHA512
638ec50615279dc084a620af27f7548a04669eaad15cb5c9dbb7db4b826d23b9f6f14b5eef423b4d084f29651ed6bce89b4bd651416bdf154f1589c769f1b96b

Download Submit
\Users\Admin\nuisii.exe

Filesize
84KB

MD5
eba0f4401196ce3108436fd89e443b3b

SHA1
bd71dfe26bcb938068c2f01aa58c0b8b87cf5848

SHA256
4869832ebb02b0807d217cc601aa13dc5ffa15b10c22818fa91d92e0c4e239c3

SHA512
638ec50615279dc084a620af27f7548a04669eaad15cb5c9dbb7db4b826d23b9f6f14b5eef423b4d084f29651ed6bce89b4bd651416bdf154f1589c769f1b96b

Download Submit
memory/964-59-0x0000000000000000-mapping.dmp

Download
memory/1192-56-0x0000000076701000-0x0000000076703000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads