Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 10:13
Static task
static1
Behavioral task
behavioral1
Sample
aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe
-
Size
164KB
-
MD5
432cf3a230d204b61393dd670f9747bf
-
SHA1
11e1d3978e2fe41d6cb51857f79043b6ef01838b
-
SHA256
aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2
-
SHA512
183adebb2675fb5dbfec15412e2a73d625218f22b31318a722970e85cef05b607b094a3d026eb083d9b8df8aa7318455905597d89aceed8d3989a8ec5c522a52
-
SSDEEP
3072:77Vz57EbV93WZy844f6G06r7bkcsN2bnldN:77cbOQof6Gn7bkjKld
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wiuafe.exe -
Executes dropped EXE 1 IoCs
pid Process 948 wiuafe.exe -
Loads dropped DLL 2 IoCs
pid Process 1228 aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe 1228 aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /x" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /l" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /h" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /a" wiuafe.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /v" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /d" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /j" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /f" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /y" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /r" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /g" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /n" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /e" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /u" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /z" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /s" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /b" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /i" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /x" aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /k" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /q" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /o" wiuafe.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /w" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /t" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /m" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /c" wiuafe.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiuafe = "C:\\Users\\Admin\\wiuafe.exe /p" wiuafe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1228 aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe 948 wiuafe.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1228 aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe 948 wiuafe.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1228 wrote to memory of 948 1228 aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe 27 PID 1228 wrote to memory of 948 1228 aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe 27 PID 1228 wrote to memory of 948 1228 aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe 27 PID 1228 wrote to memory of 948 1228 aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe"C:\Users\Admin\AppData\Local\Temp\aa4968b5d043cd5cc074faa66ba717d75df8e9708de1591ecf2dd617600732e2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\wiuafe.exe"C:\Users\Admin\wiuafe.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5f5b3e8ffa72f7ecef9bdf0ecfa0de825
SHA15eff9ad5092d842ef275f63cf4e0354d23c81cdb
SHA256ef9670bcecd4ac4b5d922cdcbdeaf23da15bd8b0fda7bf21b6abd7faa2b815b6
SHA512b5466314a0679a0f2798a446b193a6c6246b8bb6837ba09d6e479845b8ba71d483dd7c59a67e9ea62b8ce265d6220d623d2e085ed00eae783c9f5212ea2f6253
-
Filesize
164KB
MD5f5b3e8ffa72f7ecef9bdf0ecfa0de825
SHA15eff9ad5092d842ef275f63cf4e0354d23c81cdb
SHA256ef9670bcecd4ac4b5d922cdcbdeaf23da15bd8b0fda7bf21b6abd7faa2b815b6
SHA512b5466314a0679a0f2798a446b193a6c6246b8bb6837ba09d6e479845b8ba71d483dd7c59a67e9ea62b8ce265d6220d623d2e085ed00eae783c9f5212ea2f6253
-
Filesize
164KB
MD5f5b3e8ffa72f7ecef9bdf0ecfa0de825
SHA15eff9ad5092d842ef275f63cf4e0354d23c81cdb
SHA256ef9670bcecd4ac4b5d922cdcbdeaf23da15bd8b0fda7bf21b6abd7faa2b815b6
SHA512b5466314a0679a0f2798a446b193a6c6246b8bb6837ba09d6e479845b8ba71d483dd7c59a67e9ea62b8ce265d6220d623d2e085ed00eae783c9f5212ea2f6253
-
Filesize
164KB
MD5f5b3e8ffa72f7ecef9bdf0ecfa0de825
SHA15eff9ad5092d842ef275f63cf4e0354d23c81cdb
SHA256ef9670bcecd4ac4b5d922cdcbdeaf23da15bd8b0fda7bf21b6abd7faa2b815b6
SHA512b5466314a0679a0f2798a446b193a6c6246b8bb6837ba09d6e479845b8ba71d483dd7c59a67e9ea62b8ce265d6220d623d2e085ed00eae783c9f5212ea2f6253