Analysis
-
max time kernel
152s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 19:25
Static task
static1
Behavioral task
behavioral1
Sample
664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
-
Size
224KB
-
MD5
76db1fa23c08fe920f2daa3e2423ab9f
-
SHA1
8b5187e5c8413636bb5545f1c7c9bc219f64063b
-
SHA256
664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934
-
SHA512
11221493011102a4e1b14b34a7ea40d3e4f2de8fc62aede6f1762381c07fc5e26e84479c948c49d848a41450e35136522d5cb27e129c55312b7871e69733a7f1
-
SSDEEP
1536:MiriVfOfb/awoIZsh0CF+sKE0C1rZL4H0c2BHtl1/J+iZAb+j9WCyiHC/XRXTfFV:BiA/MOFCsv/CL0+JM6WCyiHCL1psA
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" harun.exe -
Executes dropped EXE 1 IoCs
pid Process 1868 harun.exe -
Loads dropped DLL 2 IoCs
pid Process 364 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe 364 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /n" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /d" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /d" 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /b" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /w" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /x" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /m" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /i" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /s" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /v" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /t" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /c" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /h" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /e" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /j" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /a" harun.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /g" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /f" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /p" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /q" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /z" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /u" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /o" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /y" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /k" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /r" harun.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\harun = "C:\\Users\\Admin\\harun.exe /l" harun.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 364 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe 1868 harun.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 364 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe 364 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe 1868 harun.exe 1868 harun.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 364 wrote to memory of 1868 364 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe 26 PID 364 wrote to memory of 1868 364 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe 26 PID 364 wrote to memory of 1868 364 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe 26 PID 364 wrote to memory of 1868 364 664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe"C:\Users\Admin\AppData\Local\Temp\664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\harun.exe"C:\Users\Admin\harun.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1868
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD515717327ec374dead0c80cc436dc8cf4
SHA10519428c70f59e9229d88c8bef66d902567bdcfa
SHA256e6e49c897879942db7866f4bb91dfb0c4d0b686015a51facdff6a4e658b80957
SHA512cec5fbc6b609938f98157a1335bbee54a8ebe2e8d16ddc1981c1068676ff33cc7240543566e3d331e4d04ecf3311689dd4716806d20fa1bbbc185687d20cb0d6
-
Filesize
224KB
MD515717327ec374dead0c80cc436dc8cf4
SHA10519428c70f59e9229d88c8bef66d902567bdcfa
SHA256e6e49c897879942db7866f4bb91dfb0c4d0b686015a51facdff6a4e658b80957
SHA512cec5fbc6b609938f98157a1335bbee54a8ebe2e8d16ddc1981c1068676ff33cc7240543566e3d331e4d04ecf3311689dd4716806d20fa1bbbc185687d20cb0d6
-
Filesize
224KB
MD515717327ec374dead0c80cc436dc8cf4
SHA10519428c70f59e9229d88c8bef66d902567bdcfa
SHA256e6e49c897879942db7866f4bb91dfb0c4d0b686015a51facdff6a4e658b80957
SHA512cec5fbc6b609938f98157a1335bbee54a8ebe2e8d16ddc1981c1068676ff33cc7240543566e3d331e4d04ecf3311689dd4716806d20fa1bbbc185687d20cb0d6
-
Filesize
224KB
MD515717327ec374dead0c80cc436dc8cf4
SHA10519428c70f59e9229d88c8bef66d902567bdcfa
SHA256e6e49c897879942db7866f4bb91dfb0c4d0b686015a51facdff6a4e658b80957
SHA512cec5fbc6b609938f98157a1335bbee54a8ebe2e8d16ddc1981c1068676ff33cc7240543566e3d331e4d04ecf3311689dd4716806d20fa1bbbc185687d20cb0d6