Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 19:50

General

  • Target

    9684974e627473f3b2066bcf2598b9933d5ad53d0c635e270493b4aadc2bcb20.exe

  • Size

    208KB

  • MD5

    0ff14b7d789d67a7648014f8ef51841b

  • SHA1

    c72ceb4693cff9b08662c94182e48e4b5fd8d4e1

  • SHA256

    9684974e627473f3b2066bcf2598b9933d5ad53d0c635e270493b4aadc2bcb20

  • SHA512

    7b907501f045436ed54e8bae9021d36dd82debc90f43a285b4bede8f546d354a32ced46339a0fc48910785026ce08d2de5e3c4d568170a50f219f7c40df57ea9

  • SSDEEP

    6144:ZRSyInsnu5W98TFK/fObT/bGiA14DFsqmVrWpMY9F4G:ZQfnL5W98TFK/fObT/bGidIrW39F4G

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9684974e627473f3b2066bcf2598b9933d5ad53d0c635e270493b4aadc2bcb20.exe
    "C:\Users\Admin\AppData\Local\Temp\9684974e627473f3b2066bcf2598b9933d5ad53d0c635e270493b4aadc2bcb20.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\hiiub.exe
      "C:\Users\Admin\hiiub.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2644

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\hiiub.exe

    Filesize

    208KB

    MD5

    1ce61d0cf43c0fe7c66b767f277119e5

    SHA1

    c1a151addbf15240ebb3f8b9e267004ee42a8243

    SHA256

    679795b32ea1b926c44f6e3c11ffaff42bb0b900c84362b2a5633ddad3075a38

    SHA512

    93d48e197e05be2c4fd7da338511339e2d7b4eeaee985826460e3a5fef92b22a815f5aaabcbede3bbac9ee902e760bc692c6e826953efc12a83a3a33485b0fa6

  • C:\Users\Admin\hiiub.exe

    Filesize

    208KB

    MD5

    1ce61d0cf43c0fe7c66b767f277119e5

    SHA1

    c1a151addbf15240ebb3f8b9e267004ee42a8243

    SHA256

    679795b32ea1b926c44f6e3c11ffaff42bb0b900c84362b2a5633ddad3075a38

    SHA512

    93d48e197e05be2c4fd7da338511339e2d7b4eeaee985826460e3a5fef92b22a815f5aaabcbede3bbac9ee902e760bc692c6e826953efc12a83a3a33485b0fa6