Analysis
-
max time kernel
169s -
max time network
60s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 23:42
Static task
static1
Behavioral task
behavioral1
Sample
c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe
-
Size
96KB
-
MD5
719b86c96b23ce887f918a347d369342
-
SHA1
8c06f0a3fda6f5fe775fce937c3a02a15f41378e
-
SHA256
c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c
-
SHA512
2f1bd3886109fe7b12158ab833a49ca7a81ef76f5da68b500e622604b71891c8a01c45cab9e4d664a067f6280b9ffb792f93067b3d08c18582a9e7a84436361e
-
SSDEEP
1536:fjvEg52N9tyVQO8P8ychukDwjj3RJNEo/knRzdnynE7RldNEP8lijOe/NIjP:fDE/NelychMzR3Ek65Rldq/CP
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kjvieq.exe -
Executes dropped EXE 1 IoCs
pid Process 1940 kjvieq.exe -
Loads dropped DLL 2 IoCs
pid Process 864 c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe 864 c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /s" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /H" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /Z" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /J" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /j" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /x" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /Y" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /q" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /N" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /B" c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /R" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /e" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /P" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /k" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /C" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /W" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /o" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /O" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /a" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /c" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /g" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /w" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /z" kjvieq.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /L" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /r" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /G" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /y" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /p" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /S" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /U" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /V" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /A" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /T" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /n" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /b" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /M" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /X" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /i" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /l" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /d" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /B" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /v" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /D" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /I" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /K" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /m" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /F" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /u" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /Q" kjvieq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kjvieq = "C:\\Users\\Admin\\kjvieq.exe /f" kjvieq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 864 c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe 1940 kjvieq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 864 c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe 1940 kjvieq.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 864 wrote to memory of 1940 864 c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe 28 PID 864 wrote to memory of 1940 864 c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe 28 PID 864 wrote to memory of 1940 864 c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe 28 PID 864 wrote to memory of 1940 864 c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe"C:\Users\Admin\AppData\Local\Temp\c7402d688476924706b6f455fecfffed7c06fedeada88457c937e60bc5c0851c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\kjvieq.exe"C:\Users\Admin\kjvieq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1940
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD59348ff9a522a8333affa1ddf3a71b25b
SHA1e5f204df3234dc0eb793af7a5228074cad5e57ba
SHA2562d03a05032eed7b51d94a575f26d501cca5804cd034ae625b1fcd867a180ea5d
SHA51293b0377518fbbdfa7436c426c1dcf564539f1986fb697bc7cd593b329b46df045333fef2e2da5b06c97ee47bd525a097ea10c42fbf65c0fb4d6dcfd57d201bee
-
Filesize
96KB
MD59348ff9a522a8333affa1ddf3a71b25b
SHA1e5f204df3234dc0eb793af7a5228074cad5e57ba
SHA2562d03a05032eed7b51d94a575f26d501cca5804cd034ae625b1fcd867a180ea5d
SHA51293b0377518fbbdfa7436c426c1dcf564539f1986fb697bc7cd593b329b46df045333fef2e2da5b06c97ee47bd525a097ea10c42fbf65c0fb4d6dcfd57d201bee
-
Filesize
96KB
MD59348ff9a522a8333affa1ddf3a71b25b
SHA1e5f204df3234dc0eb793af7a5228074cad5e57ba
SHA2562d03a05032eed7b51d94a575f26d501cca5804cd034ae625b1fcd867a180ea5d
SHA51293b0377518fbbdfa7436c426c1dcf564539f1986fb697bc7cd593b329b46df045333fef2e2da5b06c97ee47bd525a097ea10c42fbf65c0fb4d6dcfd57d201bee
-
Filesize
96KB
MD59348ff9a522a8333affa1ddf3a71b25b
SHA1e5f204df3234dc0eb793af7a5228074cad5e57ba
SHA2562d03a05032eed7b51d94a575f26d501cca5804cd034ae625b1fcd867a180ea5d
SHA51293b0377518fbbdfa7436c426c1dcf564539f1986fb697bc7cd593b329b46df045333fef2e2da5b06c97ee47bd525a097ea10c42fbf65c0fb4d6dcfd57d201bee