Analysis
-
max time kernel
158s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 19:47
Static task
static1
Behavioral task
behavioral1
Sample
5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe
Resource
win7-20221111-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe
-
Size
88KB
-
MD5
4298f89508009f412d73e51dfafdb290
-
SHA1
344c43bd283d823b5f3a2ca0cd022c4be004dd51
-
SHA256
5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38
-
SHA512
06b6046af5899463fdeba27554e507b1af7aa8de950e3460baf2714df450624a7ed1326ad37f1d350a7a298b1b078723ba0c41a66a3d8adfc2ece285a7b7252e
-
SSDEEP
1536:ijxcq7INnm0o2tkqEZ3UCw4Gvefu+kwzz7dRc9MDESNUmqWW0:Dq7IBm2tEn9fuuRc9GLZO0
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" suiewix.exe -
Executes dropped EXE 2 IoCs
pid Process 4268 suiewix.exe 1092 suiewix.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /l" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /m" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /h" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /z" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /s" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /v" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /e" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /u" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /r" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /o" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /t" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /a" suiewix.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /i" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /f" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /c" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /g" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /b" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /y" suiewix.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /w" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /p" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /x" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /k" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /d" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /j" 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /q" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /n" suiewix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewix = "C:\\Users\\Admin\\suiewix.exe /j" suiewix.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum suiewix.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 suiewix.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\c\autorun.inf suiewix.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4808 set thread context of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 4268 set thread context of 1092 4268 suiewix.exe 81 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 560 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 560 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe 1092 suiewix.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 560 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 4268 suiewix.exe 1092 suiewix.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4808 wrote to memory of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 4808 wrote to memory of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 4808 wrote to memory of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 4808 wrote to memory of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 4808 wrote to memory of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 4808 wrote to memory of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 4808 wrote to memory of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 4808 wrote to memory of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 4808 wrote to memory of 560 4808 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 79 PID 560 wrote to memory of 4268 560 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 80 PID 560 wrote to memory of 4268 560 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 80 PID 560 wrote to memory of 4268 560 5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe 80 PID 4268 wrote to memory of 1092 4268 suiewix.exe 81 PID 4268 wrote to memory of 1092 4268 suiewix.exe 81 PID 4268 wrote to memory of 1092 4268 suiewix.exe 81 PID 4268 wrote to memory of 1092 4268 suiewix.exe 81 PID 4268 wrote to memory of 1092 4268 suiewix.exe 81 PID 4268 wrote to memory of 1092 4268 suiewix.exe 81 PID 4268 wrote to memory of 1092 4268 suiewix.exe 81 PID 4268 wrote to memory of 1092 4268 suiewix.exe 81 PID 4268 wrote to memory of 1092 4268 suiewix.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe"C:\Users\Admin\AppData\Local\Temp\5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38.exe712⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\suiewix.exe"C:\Users\Admin\suiewix.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\suiewix.exe714⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD54298f89508009f412d73e51dfafdb290
SHA1344c43bd283d823b5f3a2ca0cd022c4be004dd51
SHA2565a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38
SHA51206b6046af5899463fdeba27554e507b1af7aa8de950e3460baf2714df450624a7ed1326ad37f1d350a7a298b1b078723ba0c41a66a3d8adfc2ece285a7b7252e
-
Filesize
88KB
MD54298f89508009f412d73e51dfafdb290
SHA1344c43bd283d823b5f3a2ca0cd022c4be004dd51
SHA2565a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38
SHA51206b6046af5899463fdeba27554e507b1af7aa8de950e3460baf2714df450624a7ed1326ad37f1d350a7a298b1b078723ba0c41a66a3d8adfc2ece285a7b7252e
-
Filesize
88KB
MD54298f89508009f412d73e51dfafdb290
SHA1344c43bd283d823b5f3a2ca0cd022c4be004dd51
SHA2565a1e3b440985b82220b69ed4d3f6e633c6cf312aa1e99fdb98c5846311f2dc38
SHA51206b6046af5899463fdeba27554e507b1af7aa8de950e3460baf2714df450624a7ed1326ad37f1d350a7a298b1b078723ba0c41a66a3d8adfc2ece285a7b7252e