f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e

General

Target

f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe
Size

132KB
MD5

aa47de8e6debc2572675777331f8de8d
SHA1

bd181a7ab507a1d6891d96079dfa64344f8ff78c
SHA256

f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e
SHA512

bf41564f0c38b785e314f98006361e2929a5c4343dacda2f05b3fd181bf4fa1dba0c308e243f5e02390601d7d91363f5e24990be29d564498341500c7d665fbd
SSDEEP

1536:g5uE+mXiYDf74oed/bzAmHawpglmxJAUbU0Gvlgbs4hdGoI+ycz5OR:YuDUiGspd/b3xv2gwS3WK5OR

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exeheiiv.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	heiiv.exe

Executes dropped EXE 1 IoCs

Processes:

heiiv.exe

pid process

1476 heiiv.exe

pid	process
1476	heiiv.exe

Loads dropped DLL 2 IoCs

Processes:

f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe

pid	process
808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe
808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

heiiv.exef15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /f"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /h"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /o"	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /l"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /b"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /n"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /w"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /r"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /s"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /m"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /c"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /a"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /t"	heiiv.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /y"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /g"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /o"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /v"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /i"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /p"	heiiv.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /k"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /e"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /u"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /d"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /j"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /x"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /z"	heiiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\heiiv = "C:\\Users\\Admin\\heiiv.exe /q"	heiiv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 808 WerFault.exe f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe

pid	pid_target	process	target process
1712	808	WerFault.exe	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exeheiiv.exe

pid	process
808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe
1476	heiiv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exeheiiv.exe

pid process

808 f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe
1476 heiiv.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe

description	pid	process	target process
PID 808 wrote to memory of 1476	808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe	heiiv.exe
PID 808 wrote to memory of 1476	808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe	heiiv.exe
PID 808 wrote to memory of 1476	808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe	heiiv.exe
PID 808 wrote to memory of 1476	808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe	heiiv.exe
PID 808 wrote to memory of 1712	808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe	WerFault.exe
PID 808 wrote to memory of 1712	808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe	WerFault.exe
PID 808 wrote to memory of 1712	808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe	WerFault.exe
PID 808 wrote to memory of 1712	808	f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe
"C:\Users\Admin\AppData\Local\Temp\f15a0f3232e100045194492f81da2692ab4923e1a77b7b97e120f6c8289f7f6e.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808

C:\Users\Admin\heiiv.exe
"C:\Users\Admin\heiiv.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 880
2⤵
- Program crash
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\heiiv.exe
Filesize
132KB

MD5
1ea0525f582dcffa8e6eaaaf8c6c2e03

SHA1
775e47adaebc3f9dd76d9049dd93c1165bccd4c9

SHA256
8065eba5ad4f3390e39ee89b24132153672db1105cb1c89219b54087e36d7fd5

SHA512
4ede73f93cca1070cbadf96cfdebfae0aeb75d8c49c87526d91439657d7ea5c8819c2046b72c67ceefdacd972230dc92b6efcd63834abc3cbce0f591ffd8656c

Download Submit
C:\Users\Admin\heiiv.exe
Filesize
132KB

MD5
1ea0525f582dcffa8e6eaaaf8c6c2e03

SHA1
775e47adaebc3f9dd76d9049dd93c1165bccd4c9

SHA256
8065eba5ad4f3390e39ee89b24132153672db1105cb1c89219b54087e36d7fd5

SHA512
4ede73f93cca1070cbadf96cfdebfae0aeb75d8c49c87526d91439657d7ea5c8819c2046b72c67ceefdacd972230dc92b6efcd63834abc3cbce0f591ffd8656c

Download Submit
\Users\Admin\heiiv.exe
Filesize
132KB

MD5
1ea0525f582dcffa8e6eaaaf8c6c2e03

SHA1
775e47adaebc3f9dd76d9049dd93c1165bccd4c9

SHA256
8065eba5ad4f3390e39ee89b24132153672db1105cb1c89219b54087e36d7fd5

SHA512
4ede73f93cca1070cbadf96cfdebfae0aeb75d8c49c87526d91439657d7ea5c8819c2046b72c67ceefdacd972230dc92b6efcd63834abc3cbce0f591ffd8656c

Download Submit
\Users\Admin\heiiv.exe
Filesize
132KB

MD5
1ea0525f582dcffa8e6eaaaf8c6c2e03

SHA1
775e47adaebc3f9dd76d9049dd93c1165bccd4c9

SHA256
8065eba5ad4f3390e39ee89b24132153672db1105cb1c89219b54087e36d7fd5

SHA512
4ede73f93cca1070cbadf96cfdebfae0aeb75d8c49c87526d91439657d7ea5c8819c2046b72c67ceefdacd972230dc92b6efcd63834abc3cbce0f591ffd8656c

Download Submit
memory/808-56-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1476-59-0x0000000000000000-mapping.dmp

Download
memory/1712-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads