Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe
-
Size
60KB
-
MD5
b528a0692fb8b8b62141f2d78846949b
-
SHA1
48e6fe1ba013b7c237e516db82bb6d2e0c2c64c8
-
SHA256
5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182
-
SHA512
7393612f09dc248a876e410a07a333c030593cdfd58ed312951219ba94054b672585b569017d1719b5d27bc7684398b40e1dc253e2ce2b46a1be82df5f5049fa
-
SSDEEP
768:SQqlnyqBTFv0h6mPdSUMeW5UB/TVFIkNcwFIkid+W9KOP/3gYn6IW44spB6W8LxK:CysGRasn6RkSeHUNMo6xLwBu
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" neudoej.exe -
Executes dropped EXE 1 IoCs
pid Process 956 neudoej.exe -
Loads dropped DLL 2 IoCs
pid Process 2024 5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe 2024 5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /w" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /c" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /P" neudoej.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /H" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /l" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /W" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /S" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /a" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /G" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /J" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /Y" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /C" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /B" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /I" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /K" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /X" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /h" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /q" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /b" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /r" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /Q" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /z" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /M" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /N" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /j" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /x" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /v" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /E" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /e" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /s" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /i" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /p" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /o" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /d" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /k" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /g" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /V" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /f" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /U" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /n" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /A" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /T" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /Z" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /m" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /F" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /O" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /R" neudoej.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\neudoej = "C:\\Users\\Admin\\neudoej.exe /t" neudoej.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe 956 neudoej.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2024 5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe 956 neudoej.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 956 2024 5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe 26 PID 2024 wrote to memory of 956 2024 5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe 26 PID 2024 wrote to memory of 956 2024 5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe 26 PID 2024 wrote to memory of 956 2024 5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe 26 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25 PID 956 wrote to memory of 2024 956 neudoej.exe 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe"C:\Users\Admin\AppData\Local\Temp\5694a86c207e66c4559db87c5a1cf8d08d89b48a6612da9f327703582760c182.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\neudoej.exe"C:\Users\Admin\neudoej.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD511eec760ab46a9874a442a96c4eaf734
SHA1a28ab215a26a4a8cf2ae7a8375e2e1743a91ca6f
SHA25647849e7ba23f23e4e602ac38cb8977784f4b61f490c4919354add78aa0aaa999
SHA512ec010b26acbcdf05a21653f747a4e95f09881af8f88df149905bfd53b0e873649f56006ee005e9d224f482ec27d8255e5c5bf8e9715b0953b6861f1cb2fccc81
-
Filesize
60KB
MD511eec760ab46a9874a442a96c4eaf734
SHA1a28ab215a26a4a8cf2ae7a8375e2e1743a91ca6f
SHA25647849e7ba23f23e4e602ac38cb8977784f4b61f490c4919354add78aa0aaa999
SHA512ec010b26acbcdf05a21653f747a4e95f09881af8f88df149905bfd53b0e873649f56006ee005e9d224f482ec27d8255e5c5bf8e9715b0953b6861f1cb2fccc81
-
Filesize
60KB
MD511eec760ab46a9874a442a96c4eaf734
SHA1a28ab215a26a4a8cf2ae7a8375e2e1743a91ca6f
SHA25647849e7ba23f23e4e602ac38cb8977784f4b61f490c4919354add78aa0aaa999
SHA512ec010b26acbcdf05a21653f747a4e95f09881af8f88df149905bfd53b0e873649f56006ee005e9d224f482ec27d8255e5c5bf8e9715b0953b6861f1cb2fccc81
-
Filesize
60KB
MD511eec760ab46a9874a442a96c4eaf734
SHA1a28ab215a26a4a8cf2ae7a8375e2e1743a91ca6f
SHA25647849e7ba23f23e4e602ac38cb8977784f4b61f490c4919354add78aa0aaa999
SHA512ec010b26acbcdf05a21653f747a4e95f09881af8f88df149905bfd53b0e873649f56006ee005e9d224f482ec27d8255e5c5bf8e9715b0953b6861f1cb2fccc81