Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 06:35
Static task
static1
Behavioral task
behavioral1
Sample
bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe
Resource
win10v2004-20221111-en
General
-
Target
bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe
-
Size
104KB
-
MD5
c05544d783c008a2cc5d280c0a2f203a
-
SHA1
4191627dda5df95c9f47c8db4f6d572d4770600e
-
SHA256
bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1
-
SHA512
693a6726f9e0a3c41786090b2fe327b21df08a13b12270f40672f1af9bead692f13daad09bf3f7b0f503c75ba2a9c08ff7143aa6069650fd3950c1e68302f09c
-
SSDEEP
1536:wBLRvx+u1Ds+HBchhQKNIqpOcQv0sTEFSocwB+XjLlm:QM+eiKNZJQv0sToB+3s
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exesiuhuz.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" siuhuz.exe -
Executes dropped EXE 1 IoCs
Processes:
siuhuz.exepid process 1352 siuhuz.exe -
Loads dropped DLL 2 IoCs
Processes:
bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exepid process 1504 bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe 1504 bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe -
Adds Run key to start application 2 TTPs 29 IoCs
Processes:
siuhuz.exebf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /d" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /e" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /j" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /o" bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /q" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /r" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /s" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /y" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /i" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /u" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /b" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /t" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /h" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /n" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /a" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /k" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /f" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /l" siuhuz.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /v" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /o" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /m" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /g" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /c" siuhuz.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /p" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /x" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /w" siuhuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuhuz = "C:\\Users\\Admin\\siuhuz.exe /z" siuhuz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exesiuhuz.exepid process 1504 bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe 1352 siuhuz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exesiuhuz.exepid process 1504 bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe 1352 siuhuz.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exedescription pid process target process PID 1504 wrote to memory of 1352 1504 bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe siuhuz.exe PID 1504 wrote to memory of 1352 1504 bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe siuhuz.exe PID 1504 wrote to memory of 1352 1504 bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe siuhuz.exe PID 1504 wrote to memory of 1352 1504 bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe siuhuz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe"C:\Users\Admin\AppData\Local\Temp\bf8a377a7a55fed45ce59af9fd5f3f8c82d7ac7814f5e90ffd28c6e383a5f9a1.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\siuhuz.exe"C:\Users\Admin\siuhuz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\siuhuz.exeFilesize
104KB
MD579bdc1c5255af9002be009144cfd1596
SHA13ed3e48f06252c180f1652fe50ec26d49c077cf2
SHA25692f2f3b9ed34ccd2a89a9ca084a4f32ffc224b78b24a95f55310e8c0ab3efdb4
SHA5124e638dcf6270cb0bedeebf6a45a83a0bc69114cd919c8eb940e44a302c68480ec671a44b8852bf45e3dc81b6140d54e0d75e54a7e3247f9da206df8e318c01ff
-
C:\Users\Admin\siuhuz.exeFilesize
104KB
MD579bdc1c5255af9002be009144cfd1596
SHA13ed3e48f06252c180f1652fe50ec26d49c077cf2
SHA25692f2f3b9ed34ccd2a89a9ca084a4f32ffc224b78b24a95f55310e8c0ab3efdb4
SHA5124e638dcf6270cb0bedeebf6a45a83a0bc69114cd919c8eb940e44a302c68480ec671a44b8852bf45e3dc81b6140d54e0d75e54a7e3247f9da206df8e318c01ff
-
\Users\Admin\siuhuz.exeFilesize
104KB
MD579bdc1c5255af9002be009144cfd1596
SHA13ed3e48f06252c180f1652fe50ec26d49c077cf2
SHA25692f2f3b9ed34ccd2a89a9ca084a4f32ffc224b78b24a95f55310e8c0ab3efdb4
SHA5124e638dcf6270cb0bedeebf6a45a83a0bc69114cd919c8eb940e44a302c68480ec671a44b8852bf45e3dc81b6140d54e0d75e54a7e3247f9da206df8e318c01ff
-
\Users\Admin\siuhuz.exeFilesize
104KB
MD579bdc1c5255af9002be009144cfd1596
SHA13ed3e48f06252c180f1652fe50ec26d49c077cf2
SHA25692f2f3b9ed34ccd2a89a9ca084a4f32ffc224b78b24a95f55310e8c0ab3efdb4
SHA5124e638dcf6270cb0bedeebf6a45a83a0bc69114cd919c8eb940e44a302c68480ec671a44b8852bf45e3dc81b6140d54e0d75e54a7e3247f9da206df8e318c01ff
-
memory/1352-59-0x0000000000000000-mapping.dmp
-
memory/1504-56-0x00000000768A1000-0x00000000768A3000-memory.dmpFilesize
8KB