Analysis
-
max time kernel
219s -
max time network
203s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe
-
Size
60KB
-
MD5
ecbaf142c9c9fb53196ce0908fb4edc0
-
SHA1
12a80053b204e426866b19501899bb6f615e4ece
-
SHA256
06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173
-
SHA512
e0c4bacf66ae7a095f442503a7c8f174f2dd65fa244aa5cf3ad42a6c78aff45d4caa43b363c22b782481abc2367259d30e8a9c0763ddc54abf471f70008d1fa9
-
SSDEEP
1536:iRQvYQCLQ4gXkfyWjZRwp6/OrCF/w12TItl+zEq:tvYoXCZRwpiOY/w12TSvq
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kauquu.exe -
Executes dropped EXE 1 IoCs
pid Process 684 kauquu.exe -
Loads dropped DLL 2 IoCs
pid Process 2028 06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe 2028 06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ kauquu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kauquu = "C:\\Users\\Admin\\kauquu.exe" kauquu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe 684 kauquu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2028 06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe 684 kauquu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 684 2028 06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe 28 PID 2028 wrote to memory of 684 2028 06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe 28 PID 2028 wrote to memory of 684 2028 06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe 28 PID 2028 wrote to memory of 684 2028 06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe 28 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3 PID 684 wrote to memory of 2028 684 kauquu.exe 3
Processes
-
C:\Users\Admin\AppData\Local\Temp\06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe"C:\Users\Admin\AppData\Local\Temp\06dfd4040eef501cd982523bab40d3daab7be5e4eec620eef5e122cb6bb89173.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\kauquu.exe"C:\Users\Admin\kauquu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD539541f6b5d5544ddd12f3a8fb996fdea
SHA1b08115809aef1e65a47752bb80a7a336f33c0e75
SHA2565ad99e95f49b4807851c46a0f072a812b810b6d2362417243a5e707cc1bcd0ec
SHA51290bb09d17382b65f28118b580acb48c659394a904ca32d9d551aa2ad08b50b474f74f9290df702e40614f8cb7d7b8ffcc419b82b193512d4055090819f06bc35
-
Filesize
60KB
MD539541f6b5d5544ddd12f3a8fb996fdea
SHA1b08115809aef1e65a47752bb80a7a336f33c0e75
SHA2565ad99e95f49b4807851c46a0f072a812b810b6d2362417243a5e707cc1bcd0ec
SHA51290bb09d17382b65f28118b580acb48c659394a904ca32d9d551aa2ad08b50b474f74f9290df702e40614f8cb7d7b8ffcc419b82b193512d4055090819f06bc35
-
Filesize
60KB
MD539541f6b5d5544ddd12f3a8fb996fdea
SHA1b08115809aef1e65a47752bb80a7a336f33c0e75
SHA2565ad99e95f49b4807851c46a0f072a812b810b6d2362417243a5e707cc1bcd0ec
SHA51290bb09d17382b65f28118b580acb48c659394a904ca32d9d551aa2ad08b50b474f74f9290df702e40614f8cb7d7b8ffcc419b82b193512d4055090819f06bc35
-
Filesize
60KB
MD539541f6b5d5544ddd12f3a8fb996fdea
SHA1b08115809aef1e65a47752bb80a7a336f33c0e75
SHA2565ad99e95f49b4807851c46a0f072a812b810b6d2362417243a5e707cc1bcd0ec
SHA51290bb09d17382b65f28118b580acb48c659394a904ca32d9d551aa2ad08b50b474f74f9290df702e40614f8cb7d7b8ffcc419b82b193512d4055090819f06bc35