Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 17:16
Static task
static1
Behavioral task
behavioral1
Sample
afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe
-
Size
192KB
-
MD5
cd2d80a56db3e7123c7cd4814c047692
-
SHA1
c6a3d28c713c98a928fac5bd5523ba8a115e5c6a
-
SHA256
afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc
-
SHA512
5397c41c6fb2435505410e031be99f22f400079dd44c215f879acdbcb4bb0a46e974c404130e7c7c48546b849942c0f86150b4d1e44b5213ad1275d6ea44b66e
-
SSDEEP
1536:RbHABQruHlT7idPRi4iti93MH9iV6MRfWzzp3BHReQbIYL2XoPLJB514R9/a7rqr:V2QraTmBRi4itiSHXzp3uYTPLJO8VE
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dekij.exe -
Executes dropped EXE 1 IoCs
pid Process 1012 dekij.exe -
Loads dropped DLL 2 IoCs
pid Process 956 afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe 956 afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /g" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /b" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /s" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /a" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /d" dekij.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /f" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /r" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /k" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /e" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /c" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /y" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /l" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /j" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /w" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /x" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /o" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /a" afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /t" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /i" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /v" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /m" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /h" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /n" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /u" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /q" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /z" dekij.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dekij = "C:\\Users\\Admin\\dekij.exe /p" dekij.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 956 afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe 1012 dekij.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 956 afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe 1012 dekij.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 956 wrote to memory of 1012 956 afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe 27 PID 956 wrote to memory of 1012 956 afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe 27 PID 956 wrote to memory of 1012 956 afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe 27 PID 956 wrote to memory of 1012 956 afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe"C:\Users\Admin\AppData\Local\Temp\afd0404b7fa22beb9a8c9b1fb249cb305a17424a4424c02233ea6867e30195cc.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\dekij.exe"C:\Users\Admin\dekij.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1012
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5173043a0b1ced25ecdb30cd9146670ee
SHA1e2d0c9752fb99c74542db37c8bc61989573ab081
SHA256927f30b1b0c871bce5fe08dabf9e7c1a7ce649878b2e7567fc591c7c4691a10a
SHA51226d3e512ce2b5da362d7c03b60cfa1d5f3d53e8a9eef8c27f5b08c06fb2b427236eff6020fdcaf6972eaf1d9d71209b03727f0e124b3f9e4fea0d357d023b7e1
-
Filesize
192KB
MD5173043a0b1ced25ecdb30cd9146670ee
SHA1e2d0c9752fb99c74542db37c8bc61989573ab081
SHA256927f30b1b0c871bce5fe08dabf9e7c1a7ce649878b2e7567fc591c7c4691a10a
SHA51226d3e512ce2b5da362d7c03b60cfa1d5f3d53e8a9eef8c27f5b08c06fb2b427236eff6020fdcaf6972eaf1d9d71209b03727f0e124b3f9e4fea0d357d023b7e1
-
Filesize
192KB
MD5173043a0b1ced25ecdb30cd9146670ee
SHA1e2d0c9752fb99c74542db37c8bc61989573ab081
SHA256927f30b1b0c871bce5fe08dabf9e7c1a7ce649878b2e7567fc591c7c4691a10a
SHA51226d3e512ce2b5da362d7c03b60cfa1d5f3d53e8a9eef8c27f5b08c06fb2b427236eff6020fdcaf6972eaf1d9d71209b03727f0e124b3f9e4fea0d357d023b7e1
-
Filesize
192KB
MD5173043a0b1ced25ecdb30cd9146670ee
SHA1e2d0c9752fb99c74542db37c8bc61989573ab081
SHA256927f30b1b0c871bce5fe08dabf9e7c1a7ce649878b2e7567fc591c7c4691a10a
SHA51226d3e512ce2b5da362d7c03b60cfa1d5f3d53e8a9eef8c27f5b08c06fb2b427236eff6020fdcaf6972eaf1d9d71209b03727f0e124b3f9e4fea0d357d023b7e1