Analysis
-
max time kernel
151s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe
-
Size
124KB
-
MD5
e391b09164a875599e5c0f80852c844f
-
SHA1
e4121762db2582a82c994b62f4c32d68d73351bf
-
SHA256
a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157
-
SHA512
bb588929ecc6613445fd11e0c07f55498a3349e30346744e8344a2bc967d3236cf27c37cf99b9ecc0edc4287845198c3c8738742516fb90a3936da23eeda5d09
-
SSDEEP
3072:aaAfUEiOR+rQKGcNqnGrD6uvIepyJS6f1qrej:ahfiO4rQKGciwQJr
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lioqaez.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe -
Executes dropped EXE 1 IoCs
pid Process 1496 lioqaez.exe -
Loads dropped DLL 2 IoCs
pid Process 960 a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe 960 a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /R" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /T" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /s" lioqaez.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /d" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /Z" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /x" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /X" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /y" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /P" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /L" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /e" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /b" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /r" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /B" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /C" lioqaez.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /w" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /V" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /p" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /G" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /W" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /Q" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /S" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /g" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /K" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /q" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /M" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /k" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /u" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /D" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /Y" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /n" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /N" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /E" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /l" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /J" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /h" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /i" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /t" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /f" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /H" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /F" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /v" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /j" a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /O" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /I" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /a" lioqaez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lioqaez = "C:\\Users\\Admin\\lioqaez.exe /z" lioqaez.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 960 a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe 1496 lioqaez.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 960 a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe 1496 lioqaez.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 960 wrote to memory of 1496 960 a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe 28 PID 960 wrote to memory of 1496 960 a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe 28 PID 960 wrote to memory of 1496 960 a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe 28 PID 960 wrote to memory of 1496 960 a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe"C:\Users\Admin\AppData\Local\Temp\a8fe18e7c0db0ba56f96f1be0e88aa6857ddd232459d8bb1eda176da69362157.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\lioqaez.exe"C:\Users\Admin\lioqaez.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1496
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5af5b95cff1598ee3adef285e1a60ff08
SHA1278eb07a21bdab30f6c69281f3d04101cdf3147d
SHA256666a90e3c15a188ae38a1ee789680003aa774a82843025555cea2fb1fd675ad5
SHA51232669a4fafa32f48e0a2d70fb443899cb9ddb6fb84f27229672a94a0e564a126d2c64a3a1eebc7d619465e8cd595de1bb0a239030a709021da418d0719c0dd4b
-
Filesize
124KB
MD5af5b95cff1598ee3adef285e1a60ff08
SHA1278eb07a21bdab30f6c69281f3d04101cdf3147d
SHA256666a90e3c15a188ae38a1ee789680003aa774a82843025555cea2fb1fd675ad5
SHA51232669a4fafa32f48e0a2d70fb443899cb9ddb6fb84f27229672a94a0e564a126d2c64a3a1eebc7d619465e8cd595de1bb0a239030a709021da418d0719c0dd4b
-
Filesize
124KB
MD5af5b95cff1598ee3adef285e1a60ff08
SHA1278eb07a21bdab30f6c69281f3d04101cdf3147d
SHA256666a90e3c15a188ae38a1ee789680003aa774a82843025555cea2fb1fd675ad5
SHA51232669a4fafa32f48e0a2d70fb443899cb9ddb6fb84f27229672a94a0e564a126d2c64a3a1eebc7d619465e8cd595de1bb0a239030a709021da418d0719c0dd4b
-
Filesize
124KB
MD5af5b95cff1598ee3adef285e1a60ff08
SHA1278eb07a21bdab30f6c69281f3d04101cdf3147d
SHA256666a90e3c15a188ae38a1ee789680003aa774a82843025555cea2fb1fd675ad5
SHA51232669a4fafa32f48e0a2d70fb443899cb9ddb6fb84f27229672a94a0e564a126d2c64a3a1eebc7d619465e8cd595de1bb0a239030a709021da418d0719c0dd4b