Analysis
-
max time kernel
151s -
max time network
69s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 10:48
Static task
static1
Behavioral task
behavioral1
Sample
cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe
-
Size
48KB
-
MD5
e73eea60d2768350d0aca77d5f70de99
-
SHA1
138bc264a0ee47958ca920fa6cbca947e02fa17b
-
SHA256
cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3
-
SHA512
6370accd1a328509a5eb68ccf7ebb0459b2575747b969c3af27e92f39f9ca49195bf9df0732aa2e4880cd457b8bcca37bffbeb8cada1aafca9fedd1078e64081
-
SSDEEP
768:EpeNEhmmgmoaqpzQv+6wH9H7MfygXaDMFQXD7e:Epeamt9S6NNDsQXD7
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tiuoqu.exe -
Executes dropped EXE 1 IoCs
pid Process 944 tiuoqu.exe -
Loads dropped DLL 2 IoCs
pid Process 1964 cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe 1964 cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiuoqu = "C:\\Users\\Admin\\tiuoqu.exe" tiuoqu.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ tiuoqu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe 944 tiuoqu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1964 cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe 944 tiuoqu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 944 1964 cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe 28 PID 1964 wrote to memory of 944 1964 cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe 28 PID 1964 wrote to memory of 944 1964 cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe 28 PID 1964 wrote to memory of 944 1964 cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe 28 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27 PID 944 wrote to memory of 1964 944 tiuoqu.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe"C:\Users\Admin\AppData\Local\Temp\cb7c54f35f230df68f4904f1d3a86cb3b35395adfb1ccd0c2e2da0c45dfa07a3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\tiuoqu.exe"C:\Users\Admin\tiuoqu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5503bcb3502e6a5120c9b97ad69a5477f
SHA17730672da0bbae1fd1f57eb2a383f33e3b14eda7
SHA2564f3573d9370ee835ccde459e8a38863b49bd400c34e6acae9e612a5574243e00
SHA51200617f831895051cd6cc3c3964eaf1c8e8b90e68f9d3190072613803495442a2dce2762557564648f1885e0de4cac35c2b3339420373820a950fe12f9d692e67
-
Filesize
48KB
MD5503bcb3502e6a5120c9b97ad69a5477f
SHA17730672da0bbae1fd1f57eb2a383f33e3b14eda7
SHA2564f3573d9370ee835ccde459e8a38863b49bd400c34e6acae9e612a5574243e00
SHA51200617f831895051cd6cc3c3964eaf1c8e8b90e68f9d3190072613803495442a2dce2762557564648f1885e0de4cac35c2b3339420373820a950fe12f9d692e67
-
Filesize
48KB
MD5503bcb3502e6a5120c9b97ad69a5477f
SHA17730672da0bbae1fd1f57eb2a383f33e3b14eda7
SHA2564f3573d9370ee835ccde459e8a38863b49bd400c34e6acae9e612a5574243e00
SHA51200617f831895051cd6cc3c3964eaf1c8e8b90e68f9d3190072613803495442a2dce2762557564648f1885e0de4cac35c2b3339420373820a950fe12f9d692e67
-
Filesize
48KB
MD5503bcb3502e6a5120c9b97ad69a5477f
SHA17730672da0bbae1fd1f57eb2a383f33e3b14eda7
SHA2564f3573d9370ee835ccde459e8a38863b49bd400c34e6acae9e612a5574243e00
SHA51200617f831895051cd6cc3c3964eaf1c8e8b90e68f9d3190072613803495442a2dce2762557564648f1885e0de4cac35c2b3339420373820a950fe12f9d692e67