Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 17:20
Static task
static1
Behavioral task
behavioral1
Sample
a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe
-
Size
132KB
-
MD5
560f0b191033ab1ee8975559b31cad40
-
SHA1
0a01731f7d7ae93fa21739147ba828ddc131b901
-
SHA256
a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6
-
SHA512
e3473885f0d36f219a714c22a08b7ef3930c35af5e56d35ff841b71561379cd321fd9e2a4e67922f1e84df0f96faf73bc9f37ecd4478436cb5d85bcbd01ec9a5
-
SSDEEP
1536:addi3uQIIKZrDJZ3JuIuRWIelOQ212I/6jDSUaWpEEHCjP4YTyorkt5ycQg:EjH8IuRrjWmEiyoryLX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hhyaek.exe -
Executes dropped EXE 1 IoCs
pid Process 3476 hhyaek.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /e" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /t" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /d" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /v" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /q" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /r" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /n" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /i" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /a" hhyaek.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /p" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /o" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /h" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /j" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /u" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /x" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /z" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /w" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /f" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /g" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /m" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /c" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /l" hhyaek.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /s" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /i" a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /y" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /k" hhyaek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhyaek = "C:\\Users\\Admin\\hhyaek.exe /b" hhyaek.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4364 a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe 4364 a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe 3476 hhyaek.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4364 a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe 3476 hhyaek.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4364 wrote to memory of 3476 4364 a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe 85 PID 4364 wrote to memory of 3476 4364 a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe 85 PID 4364 wrote to memory of 3476 4364 a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe"C:\Users\Admin\AppData\Local\Temp\a4a5f68c4c9b77e3a2bd06f47d02a29e8488eb98bf9b685489383de53645d8b6.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\hhyaek.exe"C:\Users\Admin\hhyaek.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3476
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD57683df1e4e5640c904875029fde0954a
SHA13bbdac02d8e0783ea4a5ef5ffef8ff6e52ff461e
SHA256fece63c1f1d9afb96002b4e40973904a043a6051c8bf886e177631ee54c4416c
SHA512090118b6650494fc5c9c5a65b6cd03216f9ed486bd5db3a11425388cf435964e35e8ee7b033e800adc90eb6fa3a8f1b5158b54738ebfb99dd12a1705f19dd349
-
Filesize
132KB
MD57683df1e4e5640c904875029fde0954a
SHA13bbdac02d8e0783ea4a5ef5ffef8ff6e52ff461e
SHA256fece63c1f1d9afb96002b4e40973904a043a6051c8bf886e177631ee54c4416c
SHA512090118b6650494fc5c9c5a65b6cd03216f9ed486bd5db3a11425388cf435964e35e8ee7b033e800adc90eb6fa3a8f1b5158b54738ebfb99dd12a1705f19dd349