a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43

Analysis

max time kernel
112s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43.exe
Size

63KB
MD5

1fe85158282000e20534413acbce8e30
SHA1

54a34e0d87119f55d7c14f6a88003882612918fe
SHA256

a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43
SHA512

88753a4b9a0b8a67dd67b8353f29649a0dea3913ccabd88d2923515ac892b6ebf0e48016771de710ecdb7fdd3a8e2ec8ab384bc792366c00bcda1fa7dd7cc8a2
SSDEEP

768:TOfEWgIYBoJeQylDUV8NUIu0oWsV1qaZIp/Bj7YcRpaSOovHYxtxdvO:S+z1lMzGs1stvHYxtH2

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	beuiv.exe

Executes dropped EXE 1 IoCs

pid	Process
428	beuiv.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	beuiv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beuiv = "C:\\Users\\Admin\\beuiv.exe"	beuiv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
428	beuiv.exe
428	beuiv.exe
428	beuiv.exe
428	beuiv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
744	a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43.exe
428	beuiv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 428	744	a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43.exe	86
PID 744 wrote to memory of 428	744	a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43.exe	86
PID 744 wrote to memory of 428	744	a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43.exe	86
PID 428 wrote to memory of 744	428	beuiv.exe	82
PID 428 wrote to memory of 744	428	beuiv.exe	82
PID 428 wrote to memory of 744	428	beuiv.exe	82
PID 428 wrote to memory of 744	428	beuiv.exe	82

C:\Users\Admin\AppData\Local\Temp\a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43.exe
"C:\Users\Admin\AppData\Local\Temp\a3bf8e32d300c8c6b7901eef3dcc82e47ca168336a91e8f1731d9f7ddba19c43.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\beuiv.exe
  "C:\Users\Admin\beuiv.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\beuiv.exe

Filesize
63KB

MD5
1d1a349b909f03ffd6767df953cac0bb

SHA1
17d75eb8178217c1fbf300e04a12c4fee02d8c29

SHA256
316e218ee26a9256984054a1984bfb923dcb61b4c5849c0864c6a46268194bf9

SHA512
2b4ff02c448009f4a1937185e3def320deaf9f7dfb0c8bb5e99ffe9b705f428d0796769b436b2ace09d8cd7ed9a0a303b58e820f2c837ea2f969d661fc2f5f46

Download Submit
C:\Users\Admin\beuiv.exe

Filesize
63KB

MD5
1d1a349b909f03ffd6767df953cac0bb

SHA1
17d75eb8178217c1fbf300e04a12c4fee02d8c29

SHA256
316e218ee26a9256984054a1984bfb923dcb61b4c5849c0864c6a46268194bf9

SHA512
2b4ff02c448009f4a1937185e3def320deaf9f7dfb0c8bb5e99ffe9b705f428d0796769b436b2ace09d8cd7ed9a0a303b58e820f2c837ea2f969d661fc2f5f46

Download Submit