Analysis
-
max time kernel
172s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 22:55
Static task
static1
Behavioral task
behavioral1
Sample
adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe
-
Size
152KB
-
MD5
98915848d0fb84bfa2bb89d53ec4e13b
-
SHA1
7a0ac5509333dea8b915d91ac9e50ba97c6a47b1
-
SHA256
adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4
-
SHA512
22e8a0da2c29991f1fae969cb231aa973bead8c12ce284d2cd303296b9e7b9f9bf44d23540a19ec67d34bc2aea3e396924a97a1c97bbf4e246e73822b1343945
-
SSDEEP
3072:LmlHPTYhjIV+7MxJUbaxI3zQyzLBuT+Hog:C+7Mxa0yzUg
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fazut.exe -
Executes dropped EXE 1 IoCs
pid Process 3472 fazut.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /Y" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /p" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /y" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /o" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /z" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /L" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /n" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /I" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /k" fazut.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /O" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /D" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /j" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /V" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /C" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /M" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /G" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /l" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /S" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /v" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /c" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /h" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /b" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /u" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /w" fazut.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /J" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /W" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /R" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /K" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /r" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /Z" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /H" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /e" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /T" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /Q" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /A" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /d" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /g" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /N" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /P" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /s" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /f" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /X" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /x" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /i" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /a" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /F" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /m" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /a" adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /q" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /t" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /E" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /B" fazut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fazut = "C:\\Users\\Admin\\fazut.exe /U" fazut.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5104 adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe 5104 adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe 3472 fazut.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5104 adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe 3472 fazut.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5104 wrote to memory of 3472 5104 adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe 80 PID 5104 wrote to memory of 3472 5104 adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe 80 PID 5104 wrote to memory of 3472 5104 adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe"C:\Users\Admin\AppData\Local\Temp\adde0ae6f0943c890fb523048e2cd0d35305fc9804425b407b205314bc8ebad4.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\fazut.exe"C:\Users\Admin\fazut.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3472
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD54bb39e9374e9185549d5b9256a8b17af
SHA105091b89c31fb3611630a4990d477ef149a94fee
SHA2563118a6e93c0e8964e16dae446da4647d40ca88bad7eb10e6fbf59806dd231bbe
SHA5127792a638f4075b76e3cc5fce08061d067425faca79cef9dde45472a9bc24f46c047cd488249a3aa41790c446a87b4b1fc891392a8c537b820dc58bbb905c909d
-
Filesize
152KB
MD54bb39e9374e9185549d5b9256a8b17af
SHA105091b89c31fb3611630a4990d477ef149a94fee
SHA2563118a6e93c0e8964e16dae446da4647d40ca88bad7eb10e6fbf59806dd231bbe
SHA5127792a638f4075b76e3cc5fce08061d067425faca79cef9dde45472a9bc24f46c047cd488249a3aa41790c446a87b4b1fc891392a8c537b820dc58bbb905c909d