Analysis
-
max time kernel
154s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe
-
Size
256KB
-
MD5
cfef94cc97a5ab4b332b46833bbf471f
-
SHA1
0df92a3001d0cea3ff0e6c56faea2c7ebfd2b4f0
-
SHA256
951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152
-
SHA512
94c30e2d27dcad262595150fff463edffad998d70f64ca3527c259e5c164e99fdd573a61c38733e65df0081a07f9804f71d84f381e109cf5f399b18d8f87ee0a
-
SSDEEP
6144:ev7qvoNymi+7eeyz2P9NnnnFCpImnTZygoHlKnvmb7/D26UBnmbLBXSG:euvoNymi+7eOP9anTZygoHlKnvmb7/Dr
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gaeatu.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe -
Executes dropped EXE 1 IoCs
pid Process 1456 gaeatu.exe -
Loads dropped DLL 2 IoCs
pid Process 972 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe 972 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /I" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /K" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /L" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /F" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /d" gaeatu.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /M" 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /q" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /V" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /E" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /H" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /n" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /k" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /J" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /r" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /S" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /a" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /R" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /x" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /T" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /G" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /p" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /t" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /f" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /g" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /N" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /v" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /B" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /l" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /b" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /i" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /O" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /U" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /Y" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /M" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /z" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /D" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /y" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /X" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /u" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /e" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /C" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /c" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /P" gaeatu.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /m" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /Q" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /A" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /s" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /h" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /j" gaeatu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\gaeatu = "C:\\Users\\Admin\\gaeatu.exe /W" gaeatu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 972 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe 1456 gaeatu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 972 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe 1456 gaeatu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 972 wrote to memory of 1456 972 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe 28 PID 972 wrote to memory of 1456 972 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe 28 PID 972 wrote to memory of 1456 972 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe 28 PID 972 wrote to memory of 1456 972 951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe"C:\Users\Admin\AppData\Local\Temp\951f17b9ba9aceba39d4626476e6f0d0f004600f738be2e85cbec6ec8e1ff152.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\gaeatu.exe"C:\Users\Admin\gaeatu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1456
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD58e692eb0724acb1613c85629f2016037
SHA1ab3b250427fe24a6392419e22520c944240d1630
SHA25682fffc6678af5bb2673e9ccabc70ac4d0fefbd75df46818f258de08a26e719b3
SHA5123ad47488684fc634fb967da0d0cddf92e68471ab8f714e9383f24099696c9113cc3cdbcf9934aecb6f7416b3cb721abb48d8d3f4e34299669d8f3272f8b9c073
-
Filesize
256KB
MD58e692eb0724acb1613c85629f2016037
SHA1ab3b250427fe24a6392419e22520c944240d1630
SHA25682fffc6678af5bb2673e9ccabc70ac4d0fefbd75df46818f258de08a26e719b3
SHA5123ad47488684fc634fb967da0d0cddf92e68471ab8f714e9383f24099696c9113cc3cdbcf9934aecb6f7416b3cb721abb48d8d3f4e34299669d8f3272f8b9c073
-
Filesize
256KB
MD58e692eb0724acb1613c85629f2016037
SHA1ab3b250427fe24a6392419e22520c944240d1630
SHA25682fffc6678af5bb2673e9ccabc70ac4d0fefbd75df46818f258de08a26e719b3
SHA5123ad47488684fc634fb967da0d0cddf92e68471ab8f714e9383f24099696c9113cc3cdbcf9934aecb6f7416b3cb721abb48d8d3f4e34299669d8f3272f8b9c073
-
Filesize
256KB
MD58e692eb0724acb1613c85629f2016037
SHA1ab3b250427fe24a6392419e22520c944240d1630
SHA25682fffc6678af5bb2673e9ccabc70ac4d0fefbd75df46818f258de08a26e719b3
SHA5123ad47488684fc634fb967da0d0cddf92e68471ab8f714e9383f24099696c9113cc3cdbcf9934aecb6f7416b3cb721abb48d8d3f4e34299669d8f3272f8b9c073