Analysis
-
max time kernel
151s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 06:13
Static task
static1
Behavioral task
behavioral1
Sample
ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe
Resource
win10v2004-20221111-en
General
-
Target
ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe
-
Size
336KB
-
MD5
3c0ad8b80f837ddeb9723a5655c606f8
-
SHA1
c6768f851b3f32ee80883ba85eb881547bef95f2
-
SHA256
ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4
-
SHA512
3925edede73cc43090fc039736a695b2b0229b7177961fdbfd799ae0a72cdb9029f0b3f890a1cd6543b6678a40a2d2c5d3160520225db40e7901d95ce348b1ff
-
SSDEEP
6144:EDNxo2WGk1Y3nmQcuyKx5DKEJrwavj9+dU5SFd:G82WGk1Y3nmQcjKvWEJQ
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.execwfooj.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cwfooj.exe -
Executes dropped EXE 1 IoCs
Processes:
cwfooj.exepid process 1852 cwfooj.exe -
Loads dropped DLL 2 IoCs
Processes:
ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exepid process 900 ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe 900 ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe -
Adds Run key to start application 2 TTPs 29 IoCs
Processes:
cwfooj.exeffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /s" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /u" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /k" cwfooj.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /x" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /w" cwfooj.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /h" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /e" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /j" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /z" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /d" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /l" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /c" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /m" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /f" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /g" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /b" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /a" ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /n" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /r" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /t" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /i" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /q" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /p" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /v" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /y" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /o" cwfooj.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cwfooj = "C:\\Users\\Admin\\cwfooj.exe /a" cwfooj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.execwfooj.exepid process 900 ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe 1852 cwfooj.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.execwfooj.exepid process 900 ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe 1852 cwfooj.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exedescription pid process target process PID 900 wrote to memory of 1852 900 ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe cwfooj.exe PID 900 wrote to memory of 1852 900 ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe cwfooj.exe PID 900 wrote to memory of 1852 900 ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe cwfooj.exe PID 900 wrote to memory of 1852 900 ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe cwfooj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe"C:\Users\Admin\AppData\Local\Temp\ffb5df55f0a7beebe3f1a555aecd4e749a68cef63b0a54f7a060befab03e74b4.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\cwfooj.exe"C:\Users\Admin\cwfooj.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\cwfooj.exeFilesize
336KB
MD51bdba2525657eb4c1ddf7f8221e75b0f
SHA1455657a17d5f9ff8459b1c189782c46ae35b29bb
SHA2569c8f1324c4c88b4db2a0e879d5d7fac4ebd02e4ad4cb9a3ab37dbd3d539cf890
SHA512ad29659fd9b42175ae90dad2143dace91b1e4b5e82955a669be81646039dcf452a2af6226210553c828119ac2fbf63686b432555dc8cd537376d697334059542
-
C:\Users\Admin\cwfooj.exeFilesize
336KB
MD51bdba2525657eb4c1ddf7f8221e75b0f
SHA1455657a17d5f9ff8459b1c189782c46ae35b29bb
SHA2569c8f1324c4c88b4db2a0e879d5d7fac4ebd02e4ad4cb9a3ab37dbd3d539cf890
SHA512ad29659fd9b42175ae90dad2143dace91b1e4b5e82955a669be81646039dcf452a2af6226210553c828119ac2fbf63686b432555dc8cd537376d697334059542
-
\Users\Admin\cwfooj.exeFilesize
336KB
MD51bdba2525657eb4c1ddf7f8221e75b0f
SHA1455657a17d5f9ff8459b1c189782c46ae35b29bb
SHA2569c8f1324c4c88b4db2a0e879d5d7fac4ebd02e4ad4cb9a3ab37dbd3d539cf890
SHA512ad29659fd9b42175ae90dad2143dace91b1e4b5e82955a669be81646039dcf452a2af6226210553c828119ac2fbf63686b432555dc8cd537376d697334059542
-
\Users\Admin\cwfooj.exeFilesize
336KB
MD51bdba2525657eb4c1ddf7f8221e75b0f
SHA1455657a17d5f9ff8459b1c189782c46ae35b29bb
SHA2569c8f1324c4c88b4db2a0e879d5d7fac4ebd02e4ad4cb9a3ab37dbd3d539cf890
SHA512ad29659fd9b42175ae90dad2143dace91b1e4b5e82955a669be81646039dcf452a2af6226210553c828119ac2fbf63686b432555dc8cd537376d697334059542
-
memory/900-56-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/1852-59-0x0000000000000000-mapping.dmp