Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 03:01
Static task
static1
Behavioral task
behavioral1
Sample
643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe
-
Size
224KB
-
MD5
3c2ef0d4fde81145e0fb5a7bc0bb3820
-
SHA1
f7e3a90b157068d27a188d12bcf21d8880792752
-
SHA256
643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6
-
SHA512
7f62f57731aa76b960b0f7761438808841871619e643e875e8124aa7f1ea40e96b61da24d3f4f2f6a86bcef2dbefa8b608e2a1fac3e9e981a8281e803f87d40b
-
SSDEEP
3072:eXyqNsMoBuvZVpl2mclbj4Uvx+8ysNOu+2eRcKksU61JkkX39RLrw4ySKUbax2+Q:BqN5Xp4LnbmlrZ48
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" geufi.exe -
Executes dropped EXE 1 IoCs
pid Process 1764 geufi.exe -
Loads dropped DLL 2 IoCs
pid Process 1800 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe 1800 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /s" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /w" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /m" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /p" geufi.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /x" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /a" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /l" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /n" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /y" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /r" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /q" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /t" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /e" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /v" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /d" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /h" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /g" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /b" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /f" 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /k" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /j" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /i" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /c" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /u" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /f" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /o" geufi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\geufi = "C:\\Users\\Admin\\geufi.exe /z" geufi.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1800 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe 1764 geufi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1800 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe 1764 geufi.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1764 1800 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe 28 PID 1800 wrote to memory of 1764 1800 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe 28 PID 1800 wrote to memory of 1764 1800 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe 28 PID 1800 wrote to memory of 1764 1800 643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe"C:\Users\Admin\AppData\Local\Temp\643263a33c6a27be01e7c93d76e1b6c1af11f6826f02287fea35f0c101c993e6.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\geufi.exe"C:\Users\Admin\geufi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1764
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5ee570b6ac53c8391f7efb5e9534deb3c
SHA16afd1269741582d6daf30e38ad4b4f3f88f6136c
SHA256250b894b3aff95df384d65e837311d1a105956f8a4616825f9d93d2925868a32
SHA512c9a4b90275cb1464ba8874a16289d58bbdb9e402a896609468587425c11ec5e27c2d7e47e1a3042e012fe92df88fae1a3db9584a45ce786ce1121ebdd7a78546
-
Filesize
224KB
MD5ee570b6ac53c8391f7efb5e9534deb3c
SHA16afd1269741582d6daf30e38ad4b4f3f88f6136c
SHA256250b894b3aff95df384d65e837311d1a105956f8a4616825f9d93d2925868a32
SHA512c9a4b90275cb1464ba8874a16289d58bbdb9e402a896609468587425c11ec5e27c2d7e47e1a3042e012fe92df88fae1a3db9584a45ce786ce1121ebdd7a78546
-
Filesize
224KB
MD5ee570b6ac53c8391f7efb5e9534deb3c
SHA16afd1269741582d6daf30e38ad4b4f3f88f6136c
SHA256250b894b3aff95df384d65e837311d1a105956f8a4616825f9d93d2925868a32
SHA512c9a4b90275cb1464ba8874a16289d58bbdb9e402a896609468587425c11ec5e27c2d7e47e1a3042e012fe92df88fae1a3db9584a45ce786ce1121ebdd7a78546
-
Filesize
224KB
MD5ee570b6ac53c8391f7efb5e9534deb3c
SHA16afd1269741582d6daf30e38ad4b4f3f88f6136c
SHA256250b894b3aff95df384d65e837311d1a105956f8a4616825f9d93d2925868a32
SHA512c9a4b90275cb1464ba8874a16289d58bbdb9e402a896609468587425c11ec5e27c2d7e47e1a3042e012fe92df88fae1a3db9584a45ce786ce1121ebdd7a78546