Analysis
-
max time kernel
193s -
max time network
231s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe
-
Size
92KB
-
MD5
48321bd4148dc691935889153bec9b01
-
SHA1
3325776055a9bdf8a288c2ba1001c5dfff934918
-
SHA256
de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa
-
SHA512
3f14c7c1800e25b2d1d3f3ee3456c0e042285e571d9c80386175a3f96def2007e247e41c182a77f78f26a7ec73e435b38bcc7ca56bdbf75b5c86632a426425f0
-
SSDEEP
1536:XyAG0sTwGnmTkrlyn6qLhbqBO2zg1lF7ySSy2GQMw1vDmNmoe4:sLlcYBO2z0SBbNoe4
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" leaerok.exe -
Executes dropped EXE 1 IoCs
pid Process 4208 leaerok.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /w" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /h" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /x" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /b" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /k" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /o" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /p" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /q" leaerok.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\ de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /s" de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /j" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /a" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /r" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /e" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /n" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /f" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /i" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /v" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /l" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /t" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /y" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /s" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /m" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /g" leaerok.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\ leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /d" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /c" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /u" leaerok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaerok = "C:\\Users\\Admin\\leaerok.exe /z" leaerok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1100 de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe 1100 de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe 4208 leaerok.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1100 de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe 4208 leaerok.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1100 wrote to memory of 4208 1100 de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe 81 PID 1100 wrote to memory of 4208 1100 de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe 81 PID 1100 wrote to memory of 4208 1100 de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe"C:\Users\Admin\AppData\Local\Temp\de442c2f23dc44b5f9a4287928a2cf06328ed12e8cccd85dd99e3a6f38c001fa.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\leaerok.exe"C:\Users\Admin\leaerok.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4208
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD57e67b1375b7e9ad865fd80f4a15de34e
SHA1b31ecf0af0f33496761c94345d0cc3e59ab03cf2
SHA2560213ed5517aefa55a0be9f57f66c26297b2fc6a2883d490440e4b6696b58d357
SHA5127f128e0ba04ee70cdc51f9d1605c736f8b835d67e5398eaae553ee1162158bfbec151a6b5cf94de4d9b3183003a394281352721bdc52426b24702688277794bc
-
Filesize
92KB
MD57e67b1375b7e9ad865fd80f4a15de34e
SHA1b31ecf0af0f33496761c94345d0cc3e59ab03cf2
SHA2560213ed5517aefa55a0be9f57f66c26297b2fc6a2883d490440e4b6696b58d357
SHA5127f128e0ba04ee70cdc51f9d1605c736f8b835d67e5398eaae553ee1162158bfbec151a6b5cf94de4d9b3183003a394281352721bdc52426b24702688277794bc