Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 22:50
Static task
static1
Behavioral task
behavioral1
Sample
bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe
-
Size
124KB
-
MD5
e8bc21735f8d9a7c8384fe338b10733f
-
SHA1
ca0601fb285015803f31ee675a14d6fc3d16f553
-
SHA256
bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686
-
SHA512
ecf26a8d825daafad9e871158829330fb8dbfa8d41cb783865bcc98918ba1aab7d6f09d0f599af4de20b9196adc09b2abc87fb1abf55d6bc2ce2717da6029b3d
-
SSDEEP
3072:u9DATL1ylTSpwpmzSfYlWBQxQobunKaP3E/n:m8L1ylWpwc4YlWBQxQMunKd
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meokii.exe -
Executes dropped EXE 1 IoCs
pid Process 4444 meokii.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /j" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /G" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /r" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /N" meokii.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /l" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /D" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /L" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /p" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /b" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /C" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /u" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /o" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /O" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /H" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /v" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /Z" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /c" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /g" meokii.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /X" bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /J" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /W" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /m" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /I" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /y" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /P" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /x" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /M" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /i" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /f" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /X" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /B" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /w" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /E" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /T" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /Q" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /e" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /n" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /A" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /R" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /U" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /s" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /k" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /z" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /V" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /a" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /K" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /Y" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /t" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /F" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /h" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /q" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /d" meokii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokii = "C:\\Users\\Admin\\meokii.exe /S" meokii.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1716 bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe 1716 bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe 4444 meokii.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1716 bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe 4444 meokii.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1716 wrote to memory of 4444 1716 bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe 82 PID 1716 wrote to memory of 4444 1716 bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe 82 PID 1716 wrote to memory of 4444 1716 bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe"C:\Users\Admin\AppData\Local\Temp\bd3fcee84c86af55526e53a3edd7a89fcf913785718ffef2c45285c68e0e0686.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\meokii.exe"C:\Users\Admin\meokii.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4444
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD572679e841ae474a8e6de0579d7836ba2
SHA1293a941e5ee74c73a1052f96b43cff4cca512344
SHA256d3fb24342b25be87184fcb3c8ffb70f531db812efafd0d33247ea5d7a8312f2f
SHA512b11527e4628f066254ec1452e6fc5951046d8d2da80f805aaf168889a35b94d679a0d291f956a1a8895ef1cf10ca7c9d051cbd89a213e9f6172cc737089d0a37
-
Filesize
124KB
MD572679e841ae474a8e6de0579d7836ba2
SHA1293a941e5ee74c73a1052f96b43cff4cca512344
SHA256d3fb24342b25be87184fcb3c8ffb70f531db812efafd0d33247ea5d7a8312f2f
SHA512b11527e4628f066254ec1452e6fc5951046d8d2da80f805aaf168889a35b94d679a0d291f956a1a8895ef1cf10ca7c9d051cbd89a213e9f6172cc737089d0a37