Analysis
-
max time kernel
152s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 23:37
Static task
static1
Behavioral task
behavioral1
Sample
c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe
-
Size
236KB
-
MD5
7884dbaad3d606e1e658dd80ca5a35b1
-
SHA1
1bb7822ae14e1b0ced9c999b3f2ee4f00976f796
-
SHA256
c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49
-
SHA512
81f7435f72322759347137d427b58862725233a314d5b72fafe0690da88a9d1dea8b50e7536e62d5327e118805556c61e176ae1ba6a054d747c8a5aef40cdfba
-
SSDEEP
6144:X8aKCiUNxlBDe2WmHioZW+ZigxpEJAYyXSWIc9sKBar:MkLlBDeLmHioZWEigxpYAYlbc9TBar
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wouise.exe -
Executes dropped EXE 1 IoCs
pid Process 820 wouise.exe -
Loads dropped DLL 2 IoCs
pid Process 1464 c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe 1464 c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /R" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /u" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /a" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /H" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /C" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /Y" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /D" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /j" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /L" wouise.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /q" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /w" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /Z" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /S" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /h" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /x" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /p" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /b" c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /y" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /I" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /z" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /J" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /K" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /A" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /F" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /l" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /e" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /d" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /v" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /o" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /Q" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /T" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /k" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /V" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /c" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /f" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /E" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /n" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /r" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /G" wouise.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /s" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /b" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /U" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /X" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /W" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /B" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /m" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /i" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /P" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /g" wouise.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wouise = "C:\\Users\\Admin\\wouise.exe /M" wouise.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1464 c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe 820 wouise.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1464 c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe 820 wouise.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1464 wrote to memory of 820 1464 c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe 27 PID 1464 wrote to memory of 820 1464 c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe 27 PID 1464 wrote to memory of 820 1464 c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe 27 PID 1464 wrote to memory of 820 1464 c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe"C:\Users\Admin\AppData\Local\Temp\c24da792856aa34b2b2e5c5e4d94993c8af3c27bc0edc943c7dcf47808e60d49.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\wouise.exe"C:\Users\Admin\wouise.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:820
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5b42395f1af8d2a742a977c78f3d11548
SHA1d643b9ec6ca13e962e02754d3e7e9fb841b3da83
SHA256ed60f1a62892640c0113077980c8317d91665dcc02ada7d869d8fb2f6acd1a4d
SHA512e36e33ed4dadf3db2c748d53e363f537b797f709dcef3dbaf3052c34b5751005731bd9d29f167025dcfeb72f24d12df2cc7bff8b9ad1e710e16343f94a2f2090
-
Filesize
236KB
MD5b42395f1af8d2a742a977c78f3d11548
SHA1d643b9ec6ca13e962e02754d3e7e9fb841b3da83
SHA256ed60f1a62892640c0113077980c8317d91665dcc02ada7d869d8fb2f6acd1a4d
SHA512e36e33ed4dadf3db2c748d53e363f537b797f709dcef3dbaf3052c34b5751005731bd9d29f167025dcfeb72f24d12df2cc7bff8b9ad1e710e16343f94a2f2090
-
Filesize
236KB
MD5b42395f1af8d2a742a977c78f3d11548
SHA1d643b9ec6ca13e962e02754d3e7e9fb841b3da83
SHA256ed60f1a62892640c0113077980c8317d91665dcc02ada7d869d8fb2f6acd1a4d
SHA512e36e33ed4dadf3db2c748d53e363f537b797f709dcef3dbaf3052c34b5751005731bd9d29f167025dcfeb72f24d12df2cc7bff8b9ad1e710e16343f94a2f2090
-
Filesize
236KB
MD5b42395f1af8d2a742a977c78f3d11548
SHA1d643b9ec6ca13e962e02754d3e7e9fb841b3da83
SHA256ed60f1a62892640c0113077980c8317d91665dcc02ada7d869d8fb2f6acd1a4d
SHA512e36e33ed4dadf3db2c748d53e363f537b797f709dcef3dbaf3052c34b5751005731bd9d29f167025dcfeb72f24d12df2cc7bff8b9ad1e710e16343f94a2f2090