Analysis
- max time kernel
170s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
05/12/2022, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe
- Size 228KB
- Sample221205-mkhqmaba63
- SHA256 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb
- MD5 96da824ed74533bb5fc5043bffa92edd
- SHA1 9d16953f29ec0ae5a6efbc40d1429027c5d71dec
- SHA512 a3c5df848281145c5a6da47e9f606a8e2ae71e3e282c9fe9b093ac2e6cb8194f3b12f7d3e84d4c887c4c9ca756c66e1519d6abefbb004bc8ac3e9cea2be46ba6
- SSDEEP 3072:eg9vphi5UYJVFV5eDQHsuvNA05Vqtto24VmcZMUuXi46qndrFKY06Ax:fps3JrLeDQHr+uV0to24VmlUuSvqG
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" loopeg.exe - Executes dropped EXE 1 IoCs
pid Process 4272 loopeg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe - Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /y" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /x" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /N" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /G" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /P" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /Y" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /k" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /L" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /Q" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /Z" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /j" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /v" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /W" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /l" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /F" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /h" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /u" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /c" loopeg.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /o" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /E" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /C" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /m" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /r" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /i" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /V" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /p" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /e" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /S" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /Y" 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /w" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /a" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /q" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /A" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /s" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /U" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /z" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /X" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /D" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /M" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /K" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /T" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /B" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /J" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /n" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /O" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /f" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /H" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /d" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /b" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /R" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /t" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /I" loopeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loopeg = "C:\\Users\\Admin\\loopeg.exe /g" loopeg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4204 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe 4204 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe 4272 loopeg.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4204 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe 4272 loopeg.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4204 wrote to memory of 4272 4204 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe 79 PID 4204 wrote to memory of 4272 4204 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe 79 PID 4204 wrote to memory of 4272 4204 8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe"C:\Users\Admin\AppData\Local\Temp\8699bf2355e5e0e254ebcda6aa164988835345db54917c95cf42e66b8d922adb.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\loopeg.exe"C:\Users\Admin\loopeg.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4272
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\loopeg.exe
- Size 228KB
- SHA256 e47dd42928ad2a504ef0c2480b43fdc5b8b812be0d8b0e18190489ff1d8d153e
- MD5 a373cc026a0a451fe3286011b1c0e320
- SHA1 54d19cfe76b365e689f9801d3efb89dc146f4d5d
- SHA512 097817da38ec95b1684b360b356f8e058558d21d96852eb5040d07c13bbb5554f75005722578dbf34468e1cbfb6d075290df5864fa7c0f3365afbc20a77036a8
- SSDEEP 3072:egtkCi5UYJVFV5eDQHsuvNA05Vqtto24VmcZMUuXi46qndhLKY06Ax:IR3JrLeDQHr+uV0to24VmlUuSvqa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\loopeg.exe
- Size 228KB
- SHA256 e47dd42928ad2a504ef0c2480b43fdc5b8b812be0d8b0e18190489ff1d8d153e
- MD5 a373cc026a0a451fe3286011b1c0e320
- SHA1 54d19cfe76b365e689f9801d3efb89dc146f4d5d
- SHA512 097817da38ec95b1684b360b356f8e058558d21d96852eb5040d07c13bbb5554f75005722578dbf34468e1cbfb6d075290df5864fa7c0f3365afbc20a77036a8
- SSDEEP 3072:egtkCi5UYJVFV5eDQHsuvNA05Vqtto24VmcZMUuXi46qndhLKY06Ax:IR3JrLeDQHr+uV0to24VmlUuSvqa
- MD5 SHA1 SHA512 SSDEEP