Analysis
-
max time kernel
153s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe
-
Size
84KB
-
MD5
187ebed20ef31dbf7e7fe6fce1feb28e
-
SHA1
10f6959294838dd05cfca8760b65c1761cc9bd09
-
SHA256
287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426
-
SHA512
53b334b0918849e3eeffa1b748109298b4cd0154c97715275adb679decee33568d3e7b2390ca1353382e6f7eef2fb9a9028ad6418c22e43e214126bb7c55227f
-
SSDEEP
768:DyV+hOvo/OswzKvgO0jAIWi3KEyUhL7b7Yqlf4JwQltjmtTBHi7Alg:DoFvOyES76Ezh/vYlJwAitTB3lg
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" heuinoq.exe -
Executes dropped EXE 1 IoCs
pid Process 2044 heuinoq.exe -
Loads dropped DLL 2 IoCs
pid Process 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ heuinoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuinoq = "C:\\Users\\Admin\\heuinoq.exe" heuinoq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1904 364 WerFault.exe 17 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe 2044 heuinoq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 2044 heuinoq.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 364 wrote to memory of 2044 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 27 PID 364 wrote to memory of 2044 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 27 PID 364 wrote to memory of 2044 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 27 PID 364 wrote to memory of 2044 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 27 PID 364 wrote to memory of 1904 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 28 PID 364 wrote to memory of 1904 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 28 PID 364 wrote to memory of 1904 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 28 PID 364 wrote to memory of 1904 364 287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 364 2044 heuinoq.exe 17 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28 PID 2044 wrote to memory of 1904 2044 heuinoq.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe"C:\Users\Admin\AppData\Local\Temp\287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\heuinoq.exe"C:\Users\Admin\heuinoq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 8162⤵
- Program crash
PID:1904
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5ebad2d94ac69211cfd8ccdbc416a7963
SHA18149c385ef5cce4f8edea8188999812830584308
SHA256409f7a9dfcf3dcd5d9e9700cf64ff139772159d03f9521d62a814fb77fd62e65
SHA512d0bd31c710189a95466c5ec9e7e0d0837e1c58dfd6229b78b1c797ae6496aad4eddd15b834e878c9283c4d86ec5cb5b59a74d782010f8cf7f037ca8f327bcb4d
-
Filesize
84KB
MD5ebad2d94ac69211cfd8ccdbc416a7963
SHA18149c385ef5cce4f8edea8188999812830584308
SHA256409f7a9dfcf3dcd5d9e9700cf64ff139772159d03f9521d62a814fb77fd62e65
SHA512d0bd31c710189a95466c5ec9e7e0d0837e1c58dfd6229b78b1c797ae6496aad4eddd15b834e878c9283c4d86ec5cb5b59a74d782010f8cf7f037ca8f327bcb4d
-
Filesize
84KB
MD5ebad2d94ac69211cfd8ccdbc416a7963
SHA18149c385ef5cce4f8edea8188999812830584308
SHA256409f7a9dfcf3dcd5d9e9700cf64ff139772159d03f9521d62a814fb77fd62e65
SHA512d0bd31c710189a95466c5ec9e7e0d0837e1c58dfd6229b78b1c797ae6496aad4eddd15b834e878c9283c4d86ec5cb5b59a74d782010f8cf7f037ca8f327bcb4d
-
Filesize
84KB
MD5ebad2d94ac69211cfd8ccdbc416a7963
SHA18149c385ef5cce4f8edea8188999812830584308
SHA256409f7a9dfcf3dcd5d9e9700cf64ff139772159d03f9521d62a814fb77fd62e65
SHA512d0bd31c710189a95466c5ec9e7e0d0837e1c58dfd6229b78b1c797ae6496aad4eddd15b834e878c9283c4d86ec5cb5b59a74d782010f8cf7f037ca8f327bcb4d