Analysis
-
max time kernel
162s -
max time network
59s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe
-
Size
124KB
-
MD5
451b04c93bdf0b65820dae1f501f88d6
-
SHA1
5f04020ffdf2220692b9e1aef2639cdf6bb2f9bb
-
SHA256
ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36
-
SHA512
9364f0199c6f087fb8f72301845458111f8728271c5c526bb53ecea3dc71aee678d7810bbfe418b798711cfbee00e1017bba42f76d6ce675296be85afbc1506e
-
SSDEEP
1536:L9ET4wRkEjuBxLDtVdHa27J14lWxporZ45izNeG0h/x:5ET4wR3kLt6gJ1uPt45Jp
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" biihoot.exe -
Executes dropped EXE 1 IoCs
pid Process 112 biihoot.exe -
Loads dropped DLL 2 IoCs
pid Process 1160 ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe 1160 ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /P" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /j" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /t" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /G" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /s" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /z" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /h" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /U" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /g" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /S" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /b" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /X" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /m" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /L" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /i" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /F" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /A" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /a" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /Q" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /D" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /o" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /s" ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /k" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /y" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /V" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /Y" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /Z" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /E" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /q" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /e" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /J" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /N" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /T" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /x" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /f" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /R" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /l" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /C" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /I" biihoot.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /W" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /r" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /B" biihoot.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /v" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /K" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /w" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /H" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /p" biihoot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\biihoot = "C:\\Users\\Admin\\biihoot.exe /u" biihoot.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1160 ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe 112 biihoot.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1160 ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe 112 biihoot.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1160 wrote to memory of 112 1160 ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe 28 PID 1160 wrote to memory of 112 1160 ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe 28 PID 1160 wrote to memory of 112 1160 ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe 28 PID 1160 wrote to memory of 112 1160 ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe"C:\Users\Admin\AppData\Local\Temp\ab483d3172ebd65102bd8ceb751d9d9fccc0eb0b0c720f3cba3055fe994e8b36.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\biihoot.exe"C:\Users\Admin\biihoot.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:112
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5ec61314e157836e61ecd11f016dbf4d8
SHA19770bd9c43359d34c45f3240d9a9ada2708e23da
SHA25616aab5ee847cea78eb8bfa86df0ca75698c03381a6c6418744f8a11e73ab3478
SHA512d497788ece2d529cd291036b6f067e2829b0589bfb4d09705eed4222affb895becd861208cfe52fa233ab14d5c1d382a16f9f31a4e582332a3734bbf7fa7f007
-
Filesize
124KB
MD5ec61314e157836e61ecd11f016dbf4d8
SHA19770bd9c43359d34c45f3240d9a9ada2708e23da
SHA25616aab5ee847cea78eb8bfa86df0ca75698c03381a6c6418744f8a11e73ab3478
SHA512d497788ece2d529cd291036b6f067e2829b0589bfb4d09705eed4222affb895becd861208cfe52fa233ab14d5c1d382a16f9f31a4e582332a3734bbf7fa7f007
-
Filesize
124KB
MD5ec61314e157836e61ecd11f016dbf4d8
SHA19770bd9c43359d34c45f3240d9a9ada2708e23da
SHA25616aab5ee847cea78eb8bfa86df0ca75698c03381a6c6418744f8a11e73ab3478
SHA512d497788ece2d529cd291036b6f067e2829b0589bfb4d09705eed4222affb895becd861208cfe52fa233ab14d5c1d382a16f9f31a4e582332a3734bbf7fa7f007
-
Filesize
124KB
MD5ec61314e157836e61ecd11f016dbf4d8
SHA19770bd9c43359d34c45f3240d9a9ada2708e23da
SHA25616aab5ee847cea78eb8bfa86df0ca75698c03381a6c6418744f8a11e73ab3478
SHA512d497788ece2d529cd291036b6f067e2829b0589bfb4d09705eed4222affb895becd861208cfe52fa233ab14d5c1d382a16f9f31a4e582332a3734bbf7fa7f007