Analysis
-
max time kernel
151s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe
-
Size
147KB
-
MD5
011c05eda26653f476d8ec49b6a8b210
-
SHA1
adda62a42511957bff27af877fa92205825412b7
-
SHA256
6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a
-
SHA512
3eef1f038e624789ed9552a5287392a0d4f6d82fe1a96dae8d9dbeb9be51d993dc86b5dccd960886df7362376feb38fd8f49f3dc90f55e191ad88ad44d298659
-
SSDEEP
3072:O56HRfBL8MFZ4OneMAytfhdbYzQvIc6RBB4:7RfBoYZNdcvc6
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zuutet.exe -
Executes dropped EXE 2 IoCs
pid Process 4884 zuutet.exe 860 zuutet.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /a" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /g" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /w" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /j" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /v" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /x" zuutet.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /d" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /y" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /f" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /s" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /n" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /t" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /h" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /r" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /l" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /c" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /q" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /e" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /z" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /m" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /k" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /i" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /p" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /b" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /k" 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /u" zuutet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuutet = "C:\\Users\\Admin\\zuutet.exe /o" zuutet.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum zuutet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 zuutet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\c\autorun.inf zuutet.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1600 set thread context of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 4884 set thread context of 860 4884 zuutet.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3088 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 3088 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe 860 zuutet.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 3088 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 4884 zuutet.exe 860 zuutet.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1600 wrote to memory of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 1600 wrote to memory of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 1600 wrote to memory of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 1600 wrote to memory of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 1600 wrote to memory of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 1600 wrote to memory of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 1600 wrote to memory of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 1600 wrote to memory of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 1600 wrote to memory of 3088 1600 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 81 PID 3088 wrote to memory of 4884 3088 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 82 PID 3088 wrote to memory of 4884 3088 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 82 PID 3088 wrote to memory of 4884 3088 6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe 82 PID 4884 wrote to memory of 860 4884 zuutet.exe 83 PID 4884 wrote to memory of 860 4884 zuutet.exe 83 PID 4884 wrote to memory of 860 4884 zuutet.exe 83 PID 4884 wrote to memory of 860 4884 zuutet.exe 83 PID 4884 wrote to memory of 860 4884 zuutet.exe 83 PID 4884 wrote to memory of 860 4884 zuutet.exe 83 PID 4884 wrote to memory of 860 4884 zuutet.exe 83 PID 4884 wrote to memory of 860 4884 zuutet.exe 83 PID 4884 wrote to memory of 860 4884 zuutet.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe"C:\Users\Admin\AppData\Local\Temp\6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\6dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a.exe742⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\zuutet.exe"C:\Users\Admin\zuutet.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\zuutet.exe744⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:860
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147KB
MD5011c05eda26653f476d8ec49b6a8b210
SHA1adda62a42511957bff27af877fa92205825412b7
SHA2566dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a
SHA5123eef1f038e624789ed9552a5287392a0d4f6d82fe1a96dae8d9dbeb9be51d993dc86b5dccd960886df7362376feb38fd8f49f3dc90f55e191ad88ad44d298659
-
Filesize
147KB
MD5011c05eda26653f476d8ec49b6a8b210
SHA1adda62a42511957bff27af877fa92205825412b7
SHA2566dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a
SHA5123eef1f038e624789ed9552a5287392a0d4f6d82fe1a96dae8d9dbeb9be51d993dc86b5dccd960886df7362376feb38fd8f49f3dc90f55e191ad88ad44d298659
-
Filesize
147KB
MD5011c05eda26653f476d8ec49b6a8b210
SHA1adda62a42511957bff27af877fa92205825412b7
SHA2566dce29757932874ccd282a3fc93d2e17bf3c7cbdb20120a6da25042fafcdd74a
SHA5123eef1f038e624789ed9552a5287392a0d4f6d82fe1a96dae8d9dbeb9be51d993dc86b5dccd960886df7362376feb38fd8f49f3dc90f55e191ad88ad44d298659