Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 18:57
Static task
static1
Behavioral task
behavioral1
Sample
61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe
Resource
win10v2004-20220812-en
General
-
Target
61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe
-
Size
332KB
-
MD5
1c087e4778199ab95e4f7c0ceff40f0e
-
SHA1
f8766e9df570a3a641c52ec98d2c0b5c87e5f969
-
SHA256
61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024
-
SHA512
d6a0785a6e121c977ba6188d2b8d434424afddb9f30295825c1d9077cf2eb480d48a48d2ffcefc7a944ca21915edf1b9fa4dbf9b4e417e53501fe0bf2c2d8c2e
-
SSDEEP
3072:Vq9jSeaNxBuD7mEVSuekhGkYrQRVZq3eFo4ejLnlQISQLpyhZu6qyKtrlbHrs2OI:R5NxO2WGk1Y3nmQcuyKdFrs2OXuHNz
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" diaeduq.exe -
Executes dropped EXE 1 IoCs
pid Process 948 diaeduq.exe -
Loads dropped DLL 2 IoCs
pid Process 1932 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe 1932 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /b" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /x" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /m" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /i" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /w" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /s" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /y" diaeduq.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /l" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /o" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /n" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /k" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /a" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /e" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /g" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /p" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /z" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /o" 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /d" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /j" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /h" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /f" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /v" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /q" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /u" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /t" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /r" diaeduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\diaeduq = "C:\\Users\\Admin\\diaeduq.exe /c" diaeduq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1932 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe 948 diaeduq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1932 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe 948 diaeduq.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 948 1932 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe 28 PID 1932 wrote to memory of 948 1932 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe 28 PID 1932 wrote to memory of 948 1932 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe 28 PID 1932 wrote to memory of 948 1932 61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe"C:\Users\Admin\AppData\Local\Temp\61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\diaeduq.exe"C:\Users\Admin\diaeduq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD5c269be41e54e58bbed8d1bc2730ad2b7
SHA14e8c3c17fcd653b8433846e986a3e7de8d5deff0
SHA256bb7710d325d2599ce01dda5ab7988264027b4942520120535818d16fb3cea630
SHA512db94c8588084c25bc7cf07612faa6db7d7a61d5cb448faa3d13a9e0a23a92bff6c91f4d31942d2ac853e9cdfa8da499bf579c9451842770d3c0818d491cd46bc
-
Filesize
332KB
MD5c269be41e54e58bbed8d1bc2730ad2b7
SHA14e8c3c17fcd653b8433846e986a3e7de8d5deff0
SHA256bb7710d325d2599ce01dda5ab7988264027b4942520120535818d16fb3cea630
SHA512db94c8588084c25bc7cf07612faa6db7d7a61d5cb448faa3d13a9e0a23a92bff6c91f4d31942d2ac853e9cdfa8da499bf579c9451842770d3c0818d491cd46bc
-
Filesize
332KB
MD5c269be41e54e58bbed8d1bc2730ad2b7
SHA14e8c3c17fcd653b8433846e986a3e7de8d5deff0
SHA256bb7710d325d2599ce01dda5ab7988264027b4942520120535818d16fb3cea630
SHA512db94c8588084c25bc7cf07612faa6db7d7a61d5cb448faa3d13a9e0a23a92bff6c91f4d31942d2ac853e9cdfa8da499bf579c9451842770d3c0818d491cd46bc
-
Filesize
332KB
MD5c269be41e54e58bbed8d1bc2730ad2b7
SHA14e8c3c17fcd653b8433846e986a3e7de8d5deff0
SHA256bb7710d325d2599ce01dda5ab7988264027b4942520120535818d16fb3cea630
SHA512db94c8588084c25bc7cf07612faa6db7d7a61d5cb448faa3d13a9e0a23a92bff6c91f4d31942d2ac853e9cdfa8da499bf579c9451842770d3c0818d491cd46bc