Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe
-
Size
48KB
-
MD5
16596ffe6dd9f2ff7f6ac5602ce8b73b
-
SHA1
9123d005c63e2dc9b7b8acf96b0860a2bd29d58d
-
SHA256
3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b
-
SHA512
ea2bdf39e9fd5da1146c4ab5f18ba1b7c8fd76808298bd53bfe3a94e1f204172ee4b5723d1f423eb4faba53a734ff96ac6eb322d85e9b33b535d21860e6f24dd
-
SSDEEP
768:pkNEJbl6heGn8M6HtgTVH7NHaurxmWXOQfwoObuPb77eU:pIExu8M6Hml5lXAoO+H7d
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" buebud.exe -
Executes dropped EXE 1 IoCs
pid Process 904 buebud.exe -
Loads dropped DLL 2 IoCs
pid Process 1844 3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe 1844 3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ buebud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\buebud = "C:\\Users\\Admin\\buebud.exe" buebud.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe 904 buebud.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1844 3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe 904 buebud.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1844 wrote to memory of 904 1844 3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe 27 PID 1844 wrote to memory of 904 1844 3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe 27 PID 1844 wrote to memory of 904 1844 3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe 27 PID 1844 wrote to memory of 904 1844 3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe 27 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19 PID 904 wrote to memory of 1844 904 buebud.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe"C:\Users\Admin\AppData\Local\Temp\3ed650922cf603700870512f2d602605ac45d156947b4d9442924fbeb290fa4b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\buebud.exe"C:\Users\Admin\buebud.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD533ac90b9b6e9de4979d48317641f8621
SHA1b27c6817dc47e5d7116b6f2b6ff62167bbe7ca27
SHA25631c379750a98409461d35e887b197553de07905fc4f06c89b346b83d4c56d97c
SHA512695be8b9dab2ba7a7dfc4749a3a275b107da1a2a6c77dd6c5f30cdf6f0ea4868a074f31490df79f1142442768542a2db54fc4442a9d29331ac821cecc4af6b22
-
Filesize
48KB
MD533ac90b9b6e9de4979d48317641f8621
SHA1b27c6817dc47e5d7116b6f2b6ff62167bbe7ca27
SHA25631c379750a98409461d35e887b197553de07905fc4f06c89b346b83d4c56d97c
SHA512695be8b9dab2ba7a7dfc4749a3a275b107da1a2a6c77dd6c5f30cdf6f0ea4868a074f31490df79f1142442768542a2db54fc4442a9d29331ac821cecc4af6b22
-
Filesize
48KB
MD533ac90b9b6e9de4979d48317641f8621
SHA1b27c6817dc47e5d7116b6f2b6ff62167bbe7ca27
SHA25631c379750a98409461d35e887b197553de07905fc4f06c89b346b83d4c56d97c
SHA512695be8b9dab2ba7a7dfc4749a3a275b107da1a2a6c77dd6c5f30cdf6f0ea4868a074f31490df79f1142442768542a2db54fc4442a9d29331ac821cecc4af6b22
-
Filesize
48KB
MD533ac90b9b6e9de4979d48317641f8621
SHA1b27c6817dc47e5d7116b6f2b6ff62167bbe7ca27
SHA25631c379750a98409461d35e887b197553de07905fc4f06c89b346b83d4c56d97c
SHA512695be8b9dab2ba7a7dfc4749a3a275b107da1a2a6c77dd6c5f30cdf6f0ea4868a074f31490df79f1142442768542a2db54fc4442a9d29331ac821cecc4af6b22