Analysis
- max time kernel
157s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
29/11/2022, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe
Resource
win7-20221111-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe
- Size 123KB
- Sample221129-qp2wvafe41
- SHA256 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4
- MD5 017e767b45084bf75b936ff997fae7a0
- SHA1 d87aa65526d03ff41f6faa68f80000ec67ef4ec4
- SHA512 f5149a66daf110523369db28606fc36139d697bd3aeda84b7486de22cb182dab305d111e14d04bba86df969ae21a6b57b3b367f3c7e04f4d0ae4480fffd6545a
- SSDEEP 3072:En6T9wzThIuVwkK7MK+0t5pD2Rpjq9rYXxq:E6T9wzThR5K7MmRMzI
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" veguq.exe - Executes dropped EXE 2 IoCs
pid Process 4140 veguq.exe 3696 veguq.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe - Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /i" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /h" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /w" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /p" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /l" veguq.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /b" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /x" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /v" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /e" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /l" d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /n" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /z" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /k" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /a" veguq.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /c" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /t" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /r" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /j" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /g" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /m" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /s" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /d" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /f" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /u" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /o" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /q" veguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\veguq = "C:\\Users\\Admin\\veguq.exe /y" veguq.exe - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum veguq.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 veguq.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\c\autorun.inf veguq.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4568 set thread context of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 4140 set thread context of 3696 4140 veguq.exe 82 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1672 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 1672 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe 3696 veguq.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 1672 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 4140 veguq.exe 3696 veguq.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4568 wrote to memory of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 4568 wrote to memory of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 4568 wrote to memory of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 4568 wrote to memory of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 4568 wrote to memory of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 4568 wrote to memory of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 4568 wrote to memory of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 4568 wrote to memory of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 4568 wrote to memory of 1672 4568 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 80 PID 1672 wrote to memory of 4140 1672 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 81 PID 1672 wrote to memory of 4140 1672 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 81 PID 1672 wrote to memory of 4140 1672 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe 81 PID 4140 wrote to memory of 3696 4140 veguq.exe 82 PID 4140 wrote to memory of 3696 4140 veguq.exe 82 PID 4140 wrote to memory of 3696 4140 veguq.exe 82 PID 4140 wrote to memory of 3696 4140 veguq.exe 82 PID 4140 wrote to memory of 3696 4140 veguq.exe 82 PID 4140 wrote to memory of 3696 4140 veguq.exe 82 PID 4140 wrote to memory of 3696 4140 veguq.exe 82 PID 4140 wrote to memory of 3696 4140 veguq.exe 82 PID 4140 wrote to memory of 3696 4140 veguq.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe"C:\Users\Admin\AppData\Local\Temp\d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4.exe742⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\veguq.exe"C:\Users\Admin\veguq.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\veguq.exe744⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3696
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\veguq.exe
- Size 123KB
- SHA256 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4
- MD5 017e767b45084bf75b936ff997fae7a0
- SHA1 d87aa65526d03ff41f6faa68f80000ec67ef4ec4
- SHA512 f5149a66daf110523369db28606fc36139d697bd3aeda84b7486de22cb182dab305d111e14d04bba86df969ae21a6b57b3b367f3c7e04f4d0ae4480fffd6545a
- SSDEEP 3072:En6T9wzThIuVwkK7MK+0t5pD2Rpjq9rYXxq:E6T9wzThR5K7MmRMzI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\veguq.exe
- Size 123KB
- SHA256 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4
- MD5 017e767b45084bf75b936ff997fae7a0
- SHA1 d87aa65526d03ff41f6faa68f80000ec67ef4ec4
- SHA512 f5149a66daf110523369db28606fc36139d697bd3aeda84b7486de22cb182dab305d111e14d04bba86df969ae21a6b57b3b367f3c7e04f4d0ae4480fffd6545a
- SSDEEP 3072:En6T9wzThIuVwkK7MK+0t5pD2Rpjq9rYXxq:E6T9wzThR5K7MmRMzI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\veguq.exe
- Size 123KB
- SHA256 d28b35a4eac2b9ddcc9ec698a942e8ce02ffb70b21c14cbbccd3d70c180a4be4
- MD5 017e767b45084bf75b936ff997fae7a0
- SHA1 d87aa65526d03ff41f6faa68f80000ec67ef4ec4
- SHA512 f5149a66daf110523369db28606fc36139d697bd3aeda84b7486de22cb182dab305d111e14d04bba86df969ae21a6b57b3b367f3c7e04f4d0ae4480fffd6545a
- SSDEEP 3072:En6T9wzThIuVwkK7MK+0t5pD2Rpjq9rYXxq:E6T9wzThR5K7MmRMzI
- MD5 SHA1 SHA512 SSDEEP