Analysis
-
max time kernel
261s -
max time network
335s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 07:27
Static task
static1
Behavioral task
behavioral1
Sample
78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe
-
Size
124KB
-
MD5
13189e912bba47fec4a40b018ceae910
-
SHA1
aea5250c4bbd600ce0842c41fe538b20b376b1b9
-
SHA256
78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5
-
SHA512
55dbdb463643dcf496fc16f0c80e88b6c8a2d6227db32c6c56aeb63987247fdddd18144590840adfcac9889f2a6b8d8d34a3610c6c22cf80f2478d1be8e37229
-
SSDEEP
1536:XrbjEFQ/67NxkiQixA+alh98r8Y9USv1jyPwo7JaS1:bbjEFQ/67gjH8ri8iwQL
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cueza.exe -
Executes dropped EXE 1 IoCs
pid Process 1684 cueza.exe -
Loads dropped DLL 2 IoCs
pid Process 1324 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe 1324 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /Q" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /f" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /U" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /F" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /l" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /r" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /j" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /X" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /a" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /J" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /o" cueza.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /s" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /u" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /B" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /e" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /C" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /I" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /T" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /n" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /m" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /v" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /L" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /R" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /t" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /h" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /q" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /A" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /H" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /W" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /G" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /E" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /d" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /N" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /m" 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /D" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /c" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /z" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /b" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /g" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /P" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /k" cueza.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /Z" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /M" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /x" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /w" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /K" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /V" cueza.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cueza = "C:\\Users\\Admin\\cueza.exe /p" cueza.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1324 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe 1684 cueza.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1324 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe 1684 cueza.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1684 1324 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe 28 PID 1324 wrote to memory of 1684 1324 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe 28 PID 1324 wrote to memory of 1684 1324 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe 28 PID 1324 wrote to memory of 1684 1324 78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe"C:\Users\Admin\AppData\Local\Temp\78e6fd4cb4e3c394486b383721115cb65368e6e4065a3e503a0e447c8b63b0b5.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\cueza.exe"C:\Users\Admin\cueza.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1684
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD510b62947eb369186b333e03aa2cf19dc
SHA13d4933e5557138fba290133600ae8d7d4c6ec3cc
SHA256c6f799a58248b73dedd09420cdc47365f797ecaefbebce25cd617abdd8ffe60f
SHA51262ab8cf515a6ef7d08a560718c1094f0d307f615b4a8fb359f827b407b10654131395c1ac966ea906651d7743a545bfd052a9993dbc930f52223991434a3e802
-
Filesize
124KB
MD510b62947eb369186b333e03aa2cf19dc
SHA13d4933e5557138fba290133600ae8d7d4c6ec3cc
SHA256c6f799a58248b73dedd09420cdc47365f797ecaefbebce25cd617abdd8ffe60f
SHA51262ab8cf515a6ef7d08a560718c1094f0d307f615b4a8fb359f827b407b10654131395c1ac966ea906651d7743a545bfd052a9993dbc930f52223991434a3e802
-
Filesize
124KB
MD510b62947eb369186b333e03aa2cf19dc
SHA13d4933e5557138fba290133600ae8d7d4c6ec3cc
SHA256c6f799a58248b73dedd09420cdc47365f797ecaefbebce25cd617abdd8ffe60f
SHA51262ab8cf515a6ef7d08a560718c1094f0d307f615b4a8fb359f827b407b10654131395c1ac966ea906651d7743a545bfd052a9993dbc930f52223991434a3e802
-
Filesize
124KB
MD510b62947eb369186b333e03aa2cf19dc
SHA13d4933e5557138fba290133600ae8d7d4c6ec3cc
SHA256c6f799a58248b73dedd09420cdc47365f797ecaefbebce25cd617abdd8ffe60f
SHA51262ab8cf515a6ef7d08a560718c1094f0d307f615b4a8fb359f827b407b10654131395c1ac966ea906651d7743a545bfd052a9993dbc930f52223991434a3e802