Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe
-
Size
224KB
-
MD5
12414cfe3aaf9d0957f3519ced587e49
-
SHA1
811e1a355db8089cae9bd70985478628a5f23491
-
SHA256
d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf
-
SHA512
74c57ab86e1ef6a352a988b8ebfe8c75c84a37066010829e84a891495d870763df026e3bfc429661dc380ff440d3ef38e0c67f768a9c47221ff9f434465a217b
-
SSDEEP
3072:FUHQW1D0tQ9nLHbB9W+k9ZJgImCguOelGqk:FUD4QxL7B9W+2JgIPgql
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" miozie.exe -
Executes dropped EXE 1 IoCs
pid Process 4804 miozie.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /d" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /p" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /a" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /l" miozie.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /q" d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /k" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /o" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /x" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /v" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /s" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /i" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /r" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /f" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /t" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /g" miozie.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /b" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /n" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /w" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /h" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /q" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /m" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /j" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /c" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /y" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /e" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /z" miozie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miozie = "C:\\Users\\Admin\\miozie.exe /u" miozie.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 4812 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe 4804 miozie.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4812 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 4804 miozie.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4812 wrote to memory of 4804 4812 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 80 PID 4812 wrote to memory of 4804 4812 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 80 PID 4812 wrote to memory of 4804 4812 d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe"C:\Users\Admin\AppData\Local\Temp\d845ceaab81a33bf6407938c1d4798412290d44a79644c86821d2b9ed8a62ccf.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\miozie.exe"C:\Users\Admin\miozie.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4804
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD535517d36a843b8f30bf9eea9f045944f
SHA17e432687e4a91ad6f8a47a3536af94c7f1d970a9
SHA2566e2829218f8cc69c55f7fccba6eb10b3900695f9e29c068d61a609354dc5681a
SHA5124c409f8428254a6d5723150472021f713bd6fca402faaeacf1ad0f1faba680726236efce2f985e968c5b1b8b0fd10690e80a2dea058c94ce44289f06b932a909
-
Filesize
224KB
MD535517d36a843b8f30bf9eea9f045944f
SHA17e432687e4a91ad6f8a47a3536af94c7f1d970a9
SHA2566e2829218f8cc69c55f7fccba6eb10b3900695f9e29c068d61a609354dc5681a
SHA5124c409f8428254a6d5723150472021f713bd6fca402faaeacf1ad0f1faba680726236efce2f985e968c5b1b8b0fd10690e80a2dea058c94ce44289f06b932a909