Analysis
-
max time kernel
155s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 17:05
Static task
static1
Behavioral task
behavioral1
Sample
ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe
-
Size
132KB
-
MD5
dce9d9d14c277a43356d5c926dd92a47
-
SHA1
58532e442596805d2c674075e2e618a541e27847
-
SHA256
ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5
-
SHA512
7b566d0673dba427f7d6a5cf078691c0bc452014ffa8293076518cdeaad3a74a519776fe640e7a0a9e12101db65481d63d85131550027c1f150f1149a962fbed
-
SSDEEP
3072:fanf/w6NUf6VRlxzhPak8LXo46sBizQinw:4/wiUSVPxNPaLLXoNiiMiw
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hhvouc.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe -
Executes dropped EXE 1 IoCs
pid Process 1860 hhvouc.exe -
Loads dropped DLL 2 IoCs
pid Process 1752 ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe 1752 ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /X" hhvouc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /J" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /I" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /w" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /M" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /G" hhvouc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /Q" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /S" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /f" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /k" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /a" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /O" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /D" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /z" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /y" ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /u" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /Z" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /x" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /N" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /n" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /A" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /y" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /s" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /o" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /q" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /l" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /H" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /p" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /c" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /e" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /h" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /i" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /r" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /F" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /B" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /d" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /t" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /K" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /L" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /E" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /m" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /V" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /U" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /v" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /T" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /C" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /W" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /g" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /j" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /b" hhvouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvouc = "C:\\Users\\Admin\\hhvouc.exe /Y" hhvouc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1752 ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe 1860 hhvouc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1752 ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe 1860 hhvouc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1860 1752 ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe 26 PID 1752 wrote to memory of 1860 1752 ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe 26 PID 1752 wrote to memory of 1860 1752 ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe 26 PID 1752 wrote to memory of 1860 1752 ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe"C:\Users\Admin\AppData\Local\Temp\ce898113f4a3b71bfbf73bb8c606921023cb4f40092669ce9fc0c93e434a08e5.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\hhvouc.exe"C:\Users\Admin\hhvouc.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1860
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD571da1aae684f252ef9b226d1feb3318a
SHA1630dd4ace52d6a5f2725edf7cb1acbedfdeb1170
SHA2561ce12387ef9abbe7e78060fee2fac186230718c16a0e8160659f964e821f1cff
SHA5122252afa2951b93d2b0ec1b0f8d2c15c5a573109c35b7ed530a125f343491d2caac7685e41e13d49305de66a9d2e47fdbfeddd99afaee909b561cbfd85fd81ca6
-
Filesize
132KB
MD571da1aae684f252ef9b226d1feb3318a
SHA1630dd4ace52d6a5f2725edf7cb1acbedfdeb1170
SHA2561ce12387ef9abbe7e78060fee2fac186230718c16a0e8160659f964e821f1cff
SHA5122252afa2951b93d2b0ec1b0f8d2c15c5a573109c35b7ed530a125f343491d2caac7685e41e13d49305de66a9d2e47fdbfeddd99afaee909b561cbfd85fd81ca6
-
Filesize
132KB
MD571da1aae684f252ef9b226d1feb3318a
SHA1630dd4ace52d6a5f2725edf7cb1acbedfdeb1170
SHA2561ce12387ef9abbe7e78060fee2fac186230718c16a0e8160659f964e821f1cff
SHA5122252afa2951b93d2b0ec1b0f8d2c15c5a573109c35b7ed530a125f343491d2caac7685e41e13d49305de66a9d2e47fdbfeddd99afaee909b561cbfd85fd81ca6
-
Filesize
132KB
MD571da1aae684f252ef9b226d1feb3318a
SHA1630dd4ace52d6a5f2725edf7cb1acbedfdeb1170
SHA2561ce12387ef9abbe7e78060fee2fac186230718c16a0e8160659f964e821f1cff
SHA5122252afa2951b93d2b0ec1b0f8d2c15c5a573109c35b7ed530a125f343491d2caac7685e41e13d49305de66a9d2e47fdbfeddd99afaee909b561cbfd85fd81ca6