Analysis
-
max time kernel
151s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 00:22
Static task
static1
Behavioral task
behavioral1
Sample
a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe
-
Size
240KB
-
MD5
3a64fb8501c0a0f95674f693d12732b3
-
SHA1
43aa89702e249652309cabd2a2b0486241af5d4b
-
SHA256
a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c
-
SHA512
b74ddba9c3ad9faeec8b6c117f198a6da37e077409077b6cb64309ff765534564a498b42ef2d957a6f956bdde20a80fc5f0b3433ab5a9c4075bf3307b4f95e0e
-
SSDEEP
3072:+kNuT8j6VlpvBd90i/SmWKLi7CjFSivnfu3fbMdozt5cztt:+F0UGKGkFRKfeoztO
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kieogec.exe -
Executes dropped EXE 1 IoCs
pid Process 984 kieogec.exe -
Loads dropped DLL 2 IoCs
pid Process 1720 a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe 1720 a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /l" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /i" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /u" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /g" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /f" kieogec.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /z" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /k" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /q" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /s" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /d" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /o" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /v" a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /b" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /j" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /r" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /h" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /t" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /w" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /a" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /p" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /n" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /v" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /y" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /m" kieogec.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /c" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /x" kieogec.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kieogec = "C:\\Users\\Admin\\kieogec.exe /e" kieogec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1720 a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe 984 kieogec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1720 a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe 984 kieogec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 984 1720 a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe 27 PID 1720 wrote to memory of 984 1720 a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe 27 PID 1720 wrote to memory of 984 1720 a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe 27 PID 1720 wrote to memory of 984 1720 a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe"C:\Users\Admin\AppData\Local\Temp\a3b8da3b0aa1b3c826814dd34675d4711ebdaea548c6f0ab82f3f4fbf0118a7c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\kieogec.exe"C:\Users\Admin\kieogec.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:984
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD54a2be17273706c47f9973e4a95190f5a
SHA10c66afb3a36c60619cba9fc9102e728f85307c67
SHA2567ba63bcf0610a87f519dfcd5134275e6adc887123dd6ee3f17e8a3069fac7d2d
SHA51257d17e94e58387e03da507008300ba9c550e1a8b7c069ba090a6d7aafbc220b3695fc7f28692d35034f329d8b13bfe395b7bd8840f316d1f97003d4b3a9c17df
-
Filesize
240KB
MD54a2be17273706c47f9973e4a95190f5a
SHA10c66afb3a36c60619cba9fc9102e728f85307c67
SHA2567ba63bcf0610a87f519dfcd5134275e6adc887123dd6ee3f17e8a3069fac7d2d
SHA51257d17e94e58387e03da507008300ba9c550e1a8b7c069ba090a6d7aafbc220b3695fc7f28692d35034f329d8b13bfe395b7bd8840f316d1f97003d4b3a9c17df
-
Filesize
240KB
MD54a2be17273706c47f9973e4a95190f5a
SHA10c66afb3a36c60619cba9fc9102e728f85307c67
SHA2567ba63bcf0610a87f519dfcd5134275e6adc887123dd6ee3f17e8a3069fac7d2d
SHA51257d17e94e58387e03da507008300ba9c550e1a8b7c069ba090a6d7aafbc220b3695fc7f28692d35034f329d8b13bfe395b7bd8840f316d1f97003d4b3a9c17df
-
Filesize
240KB
MD54a2be17273706c47f9973e4a95190f5a
SHA10c66afb3a36c60619cba9fc9102e728f85307c67
SHA2567ba63bcf0610a87f519dfcd5134275e6adc887123dd6ee3f17e8a3069fac7d2d
SHA51257d17e94e58387e03da507008300ba9c550e1a8b7c069ba090a6d7aafbc220b3695fc7f28692d35034f329d8b13bfe395b7bd8840f316d1f97003d4b3a9c17df