c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc

General

Target

c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe
Size

88KB
MD5

dafa7b98ad193d49b6d10d18d3df9f69
SHA1

89cf6645760205f2f3b3a964c9cf28ec8dda1165
SHA256

c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc
SHA512

30260c9732d7b500194638fe1ad83729ee7bd8769b55ace3278ee5d88345df8ef96b207246e03489d31c314c01a391b248f392e6265947bfcb9664c8792583ea
SSDEEP

1536:SItuKIQ/JDHKa5LJW6/Z2NZQCvDmNmopA:b8KI8DHKuFOrNopA

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exenuifa.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nuifa.exe

Executes dropped EXE 1 IoCs

Processes:

nuifa.exe

pid process

1604 nuifa.exe

pid	process
1604	nuifa.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

nuifa.exec77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /m"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /t"	nuifa.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /r"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /i"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /c"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /j"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /w"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /r"	c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /l"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /u"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /g"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /p"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /y"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /e"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /n"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /z"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /f"	nuifa.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /h"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /x"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /v"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /q"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /k"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /o"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /d"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /a"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /b"	nuifa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuifa = "C:\\Users\\Admin\\nuifa.exe /s"	nuifa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exenuifa.exe

pid	process
2084	c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe
2084	c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe
1604	nuifa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exenuifa.exe

pid process

2084 c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe
1604 nuifa.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe

description	pid	process	target process
PID 2084 wrote to memory of 1604	2084	c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe	nuifa.exe
PID 2084 wrote to memory of 1604	2084	c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe	nuifa.exe
PID 2084 wrote to memory of 1604	2084	c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe	nuifa.exe

C:\Users\Admin\AppData\Local\Temp\c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe
"C:\Users\Admin\AppData\Local\Temp\c77fbb353d39dbd0b8c90960f32a0d51409c8456561b253ba19896350cbdd9dc.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084

C:\Users\Admin\nuifa.exe
"C:\Users\Admin\nuifa.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1604

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\nuifa.exe
Filesize
88KB

MD5
6548be9d63e4f42cf698c67b2deb2b25

SHA1
87dbf640431059182976c0003577419588cc91e8

SHA256
4b09dce66a2dc068967f4371ce3024d9fd957ccfcd59a31e48ce098f5952ad15

SHA512
bedcdddefa3bf690cd9f442e7583c10db7dff0e7c9598bc962cda3082ae83f1f96db52791d61916262a1e503e4f647e6ec58de27fd8054a1dadea75ce77fa680

Download Submit
C:\Users\Admin\nuifa.exe
Filesize
88KB

MD5
6548be9d63e4f42cf698c67b2deb2b25

SHA1
87dbf640431059182976c0003577419588cc91e8

SHA256
4b09dce66a2dc068967f4371ce3024d9fd957ccfcd59a31e48ce098f5952ad15

SHA512
bedcdddefa3bf690cd9f442e7583c10db7dff0e7c9598bc962cda3082ae83f1f96db52791d61916262a1e503e4f647e6ec58de27fd8054a1dadea75ce77fa680

Download Submit
memory/1604-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads