Analysis
-
max time kernel
152s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 20:03
Static task
static1
Behavioral task
behavioral1
Sample
93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe
-
Size
196KB
-
MD5
55581cbb6245c9763aaef38a74d380e1
-
SHA1
6347ec4f5577fe62d040d13f8b255539b6a135c6
-
SHA256
93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921
-
SHA512
8c9b0e5b446865c245c9d1637a3ad1df6fb934d7915cf969e55633d744fc245fdeb31134056326aee08bbe12d5d17dc7792a97127198277383ab9a1153437763
-
SSDEEP
3072:yyDt50tQ9nLHbB9WJvA7DejJuKvEhfmFQ6:B4QxL7B9WSvejJuBwZ
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bunep.exe -
Executes dropped EXE 1 IoCs
pid Process 1580 bunep.exe -
Loads dropped DLL 2 IoCs
pid Process 1224 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe 1224 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /l" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /z" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /g" bunep.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /d" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /e" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /h" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /i" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /q" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /w" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /c" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /y" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /v" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /j" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /b" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /p" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /m" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /n" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /a" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /t" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /x" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /w" 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /s" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /r" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /k" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /u" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /f" bunep.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bunep = "C:\\Users\\Admin\\bunep.exe /o" bunep.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1224 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe 1580 bunep.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1224 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe 1580 bunep.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1580 1224 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe 28 PID 1224 wrote to memory of 1580 1224 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe 28 PID 1224 wrote to memory of 1580 1224 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe 28 PID 1224 wrote to memory of 1580 1224 93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe"C:\Users\Admin\AppData\Local\Temp\93f58fbcfe5ff3d7ef93edffdd705069cf16cf5208e270375fbe60091f3ec921.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\bunep.exe"C:\Users\Admin\bunep.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD588516988826e01066846cd2154628e4d
SHA16be9eb5f7fd588d5d4c0a0c3416183a701dfbcd6
SHA2567f0f7018ae3e7e156dd8378db610cc172f4cb7a9b80a9f9b9d0b48bd6e290b74
SHA512ba5a594720519394e833078f70c46df813777616681584233033dabff3f08139bbf9be314ce737af52e3291f884dfe88bb2813d989453feee94a253cd0549f0c
-
Filesize
196KB
MD588516988826e01066846cd2154628e4d
SHA16be9eb5f7fd588d5d4c0a0c3416183a701dfbcd6
SHA2567f0f7018ae3e7e156dd8378db610cc172f4cb7a9b80a9f9b9d0b48bd6e290b74
SHA512ba5a594720519394e833078f70c46df813777616681584233033dabff3f08139bbf9be314ce737af52e3291f884dfe88bb2813d989453feee94a253cd0549f0c
-
Filesize
196KB
MD588516988826e01066846cd2154628e4d
SHA16be9eb5f7fd588d5d4c0a0c3416183a701dfbcd6
SHA2567f0f7018ae3e7e156dd8378db610cc172f4cb7a9b80a9f9b9d0b48bd6e290b74
SHA512ba5a594720519394e833078f70c46df813777616681584233033dabff3f08139bbf9be314ce737af52e3291f884dfe88bb2813d989453feee94a253cd0549f0c
-
Filesize
196KB
MD588516988826e01066846cd2154628e4d
SHA16be9eb5f7fd588d5d4c0a0c3416183a701dfbcd6
SHA2567f0f7018ae3e7e156dd8378db610cc172f4cb7a9b80a9f9b9d0b48bd6e290b74
SHA512ba5a594720519394e833078f70c46df813777616681584233033dabff3f08139bbf9be314ce737af52e3291f884dfe88bb2813d989453feee94a253cd0549f0c