Analysis
-
max time kernel
159s -
max time network
219s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe
-
Size
132KB
-
MD5
023d9b98534c5d2705a001ada332357c
-
SHA1
57a116d210a5aec5474a9533cb027b42f8d8810a
-
SHA256
b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5
-
SHA512
cc3397cb876d47457d372c23bc82f758c47edff548fab112d41d71972275059453ec11be8ba2b1d1871c63988e249c3f265ba889c6fc0117087885c2caef68d2
-
SSDEEP
3072:yfrRcYbtX6RzvyuOi89Sey1AtWZXl7miWmn/Ao1:yf2OtX6RzvyuOQe7WbScA
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bdyeiz.exe -
Executes dropped EXE 1 IoCs
pid Process 3200 bdyeiz.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /z" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /h" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /C" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /d" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /L" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /d" b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /J" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /e" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /u" bdyeiz.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /x" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /B" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /w" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /a" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /k" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /o" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /j" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /c" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /R" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /G" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /b" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /A" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /P" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /t" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /f" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /Y" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /O" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /n" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /V" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /q" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /Z" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /i" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /T" bdyeiz.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /N" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /v" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /U" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /K" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /W" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /H" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /Q" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /p" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /s" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /l" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /X" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /S" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /y" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /r" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /F" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /I" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /g" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /E" bdyeiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdyeiz = "C:\\Users\\Admin\\bdyeiz.exe /D" bdyeiz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3436 b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe 3436 b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe 3200 bdyeiz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3436 b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe 3200 bdyeiz.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3436 wrote to memory of 3200 3436 b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe 82 PID 3436 wrote to memory of 3200 3436 b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe 82 PID 3436 wrote to memory of 3200 3436 b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe"C:\Users\Admin\AppData\Local\Temp\b8c741c7b9caaf2b25023336ba377523cf0214937abb90b375b49fd50466dff5.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\bdyeiz.exe"C:\Users\Admin\bdyeiz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3200
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5f055594e04996a715ef03353a594af7c
SHA1290810345570d6cd9064532d6783bfb4cacf0314
SHA256ea1a3e91059e95c344cc4dccb39a07afc64cfcf34589f297aa6fd894f3afa4d6
SHA512b922e027bd015652fcfea92be7c98ea6666ae4d44dfa6529889636430c0c919b525cbb33c906209773154e5d82a2e96f6f5209f9b395c7eee1b661657bb2f1d6
-
Filesize
132KB
MD5f055594e04996a715ef03353a594af7c
SHA1290810345570d6cd9064532d6783bfb4cacf0314
SHA256ea1a3e91059e95c344cc4dccb39a07afc64cfcf34589f297aa6fd894f3afa4d6
SHA512b922e027bd015652fcfea92be7c98ea6666ae4d44dfa6529889636430c0c919b525cbb33c906209773154e5d82a2e96f6f5209f9b395c7eee1b661657bb2f1d6