Analysis
-
max time kernel
122s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 22:58
Static task
static1
Behavioral task
behavioral1
Sample
a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe
-
Size
88KB
-
MD5
5d2a91a6e7ed47ee91aeada4679d1f53
-
SHA1
4d32b7895a153c2b030505b000076d883ea25a15
-
SHA256
a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68
-
SHA512
24bdb12b772245eaddca748657b1681c775f401e4770c54f1981f800ac008e36dc4e32aa170a266c31f7bbe55ef0cb5684e79f25b674cea14c6126b6d0476074
-
SSDEEP
1536:ekUDdsDW1pLDcw3Hr+PaGme76FrknzKLqOP:7UDyDlOFonzK9
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" laedeoq.exe -
Executes dropped EXE 1 IoCs
pid Process 3852 laedeoq.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe -
Adds Run key to start application 2 TTPs 25 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /d" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /b" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /z" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /x" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /y" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /j" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /u" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /g" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /i" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /a" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /e" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /m" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /r" laedeoq.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /v" a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /t" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /h" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /l" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /v" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /o" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /n" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /f" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /w" laedeoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laedeoq = "C:\\Users\\Admin\\laedeoq.exe /c" laedeoq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5036 a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe 5036 a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe 3852 laedeoq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5036 a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe 3852 laedeoq.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5036 wrote to memory of 3852 5036 a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe 81 PID 5036 wrote to memory of 3852 5036 a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe 81 PID 5036 wrote to memory of 3852 5036 a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe"C:\Users\Admin\AppData\Local\Temp\a7748efca01ee6557ce2b5594b4f9a3246667f0c35b98dd8af00ee235f49aa68.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\laedeoq.exe"C:\Users\Admin\laedeoq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3852
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5b06dff7911b5607bc199b3686cea0398
SHA1c9cd803c02f3766f3a728b24b448871f4f235ffd
SHA256eeaaa0919ed892dcb04cd0a2e8c67dc7924794a8fa3d0a31513dbd1e87e98471
SHA5122c3533d93dbb909f814d60f1f41b5cf382eb044e6582c0a66f7eab116e68cc5b902460c71eb315ad90b00434576514a8bbf5d41d4ff1bafdc4f71f343f68b32d
-
Filesize
88KB
MD5b06dff7911b5607bc199b3686cea0398
SHA1c9cd803c02f3766f3a728b24b448871f4f235ffd
SHA256eeaaa0919ed892dcb04cd0a2e8c67dc7924794a8fa3d0a31513dbd1e87e98471
SHA5122c3533d93dbb909f814d60f1f41b5cf382eb044e6582c0a66f7eab116e68cc5b902460c71eb315ad90b00434576514a8bbf5d41d4ff1bafdc4f71f343f68b32d