Analysis
-
max time kernel
150s -
max time network
80s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe
-
Size
96KB
-
MD5
e8917e77ca94eb956e49750f3cafe174
-
SHA1
3fe4d21b3ae4dba67c33da1d680daed92a34d09b
-
SHA256
7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b
-
SHA512
75ff65b6dbbc2dfd0f115f68c24c6f6dc6b95aa7cc965a87134e79480a791e9d1af2e90dfe6aa4097e857f2ff7e12ef48567b8b4bd6dbabebbd5337ca73f421a
-
SSDEEP
1536:pxQBH7f6cO/hwkGulSc16l6u+NMMl/KlYv1Tq5ThFgNIjnZbG:mwh5lu8CFFgCn5G
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cuagao.exe -
Executes dropped EXE 1 IoCs
pid Process 764 cuagao.exe -
Loads dropped DLL 2 IoCs
pid Process 620 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe 620 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /B" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /q" 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /H" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /V" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /A" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /l" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /W" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /Z" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /q" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /m" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /o" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /g" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /C" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /e" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /K" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /c" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /U" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /h" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /j" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /N" cuagao.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /v" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /n" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /a" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /r" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /p" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /k" cuagao.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /O" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /L" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /y" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /b" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /F" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /Y" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /I" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /Q" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /X" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /T" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /i" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /d" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /R" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /E" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /S" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /w" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /t" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /G" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /f" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /x" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /M" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /J" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /P" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /u" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /s" cuagao.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuagao = "C:\\Users\\Admin\\cuagao.exe /z" cuagao.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 620 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe 764 cuagao.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 620 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe 764 cuagao.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 620 wrote to memory of 764 620 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe 27 PID 620 wrote to memory of 764 620 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe 27 PID 620 wrote to memory of 764 620 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe 27 PID 620 wrote to memory of 764 620 7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe"C:\Users\Admin\AppData\Local\Temp\7ac08c5afe0e4add6668cd5e5b1fec7ade904f11597a7bd565264ffc0edff36b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\cuagao.exe"C:\Users\Admin\cuagao.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:764
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5775d16950ed1202a1d75fec6f856726c
SHA19de5a48bb15894e9e2027b0a80392703cfaca083
SHA2562c1b12fe0d2ca0bc166f7b67c201ac2486e0997cfe34ddd3edc450bc889c340f
SHA5122117c1ae0ae90123d5c7765c8d485de0fa5526df1edc34c40d8ea77f354f7c99f36c5f3bddb9f74326fe199e5f9f0469676f3c9263955899670a1e8158c0cc1f
-
Filesize
96KB
MD5775d16950ed1202a1d75fec6f856726c
SHA19de5a48bb15894e9e2027b0a80392703cfaca083
SHA2562c1b12fe0d2ca0bc166f7b67c201ac2486e0997cfe34ddd3edc450bc889c340f
SHA5122117c1ae0ae90123d5c7765c8d485de0fa5526df1edc34c40d8ea77f354f7c99f36c5f3bddb9f74326fe199e5f9f0469676f3c9263955899670a1e8158c0cc1f
-
Filesize
96KB
MD5775d16950ed1202a1d75fec6f856726c
SHA19de5a48bb15894e9e2027b0a80392703cfaca083
SHA2562c1b12fe0d2ca0bc166f7b67c201ac2486e0997cfe34ddd3edc450bc889c340f
SHA5122117c1ae0ae90123d5c7765c8d485de0fa5526df1edc34c40d8ea77f354f7c99f36c5f3bddb9f74326fe199e5f9f0469676f3c9263955899670a1e8158c0cc1f
-
Filesize
96KB
MD5775d16950ed1202a1d75fec6f856726c
SHA19de5a48bb15894e9e2027b0a80392703cfaca083
SHA2562c1b12fe0d2ca0bc166f7b67c201ac2486e0997cfe34ddd3edc450bc889c340f
SHA5122117c1ae0ae90123d5c7765c8d485de0fa5526df1edc34c40d8ea77f354f7c99f36c5f3bddb9f74326fe199e5f9f0469676f3c9263955899670a1e8158c0cc1f