Analysis
-
max time kernel
204s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 02:32
Static task
static1
Behavioral task
behavioral1
Sample
ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe
-
Size
88KB
-
MD5
26439550d99f4469e72e4ed8413cedca
-
SHA1
507310521ec544bff6f8170c991435defbc0f4d9
-
SHA256
ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c
-
SHA512
82cfb8c63b9fba78edf76ed10f09fdd58ff4fdd1fcc2a26b0bced97642e618705cdc5226a2159cbfc29bb8f7810bb65cf0eb48fb82ac5fbd218d4327102ae634
-
SSDEEP
1536:nX4Mr/Ea1gQ9mMjDDUFVG/op/nooolonrooIon8rNw+o2veupwKlVBCMrY+U:op8jDDUFVGeooolonrooIonGo2veupjW
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" laemuih.exe -
Executes dropped EXE 1 IoCs
pid Process 576 laemuih.exe -
Loads dropped DLL 2 IoCs
pid Process 1324 ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe 1324 ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe -
Adds Run key to start application 2 TTPs 58 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /t" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /j" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /z" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /c" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /h" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /n" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /x" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /z" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /v" ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /j" ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /l" laemuih.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /g" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /n" laemuih.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /j" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /p" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /u" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /o" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /a" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /q" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /c" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /o" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /y" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /e" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /f" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /f" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /p" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /m" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /r" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /r" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /l" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /d" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /v" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /v" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /x" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /e" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /w" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /k" laemuih.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /y" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /s" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /a" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /k" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /t" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /h" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /b" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /d" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /u" laemuih.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /m" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /i" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /w" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /i" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /b" laemuih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /q" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /g" laemuih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\laemuih = "C:\\Users\\Admin\\laemuih.exe /s" laemuih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1324 ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe 576 laemuih.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1324 ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe 576 laemuih.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1324 wrote to memory of 576 1324 ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe 28 PID 1324 wrote to memory of 576 1324 ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe 28 PID 1324 wrote to memory of 576 1324 ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe 28 PID 1324 wrote to memory of 576 1324 ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe"C:\Users\Admin\AppData\Local\Temp\ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\laemuih.exe"C:\Users\Admin\laemuih.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:576
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD59e89cca1dfea587d31166c97f87a6108
SHA19d0711ef54c0d1f9a3bd58050997a101efb5fe40
SHA256c47c19193fae76f52fd07e535445128a698985bcbe1a1962b6a4cee18aa970f5
SHA512e929c13d3c92e848cddeb42b46b4981b7040ddd0a3e3d7a5ad61e07338d3e6284ddb77f7b86dc130ad42de6e8ef5c3d4255b83aa1298690388f79bef88a6d912
-
Filesize
88KB
MD59e89cca1dfea587d31166c97f87a6108
SHA19d0711ef54c0d1f9a3bd58050997a101efb5fe40
SHA256c47c19193fae76f52fd07e535445128a698985bcbe1a1962b6a4cee18aa970f5
SHA512e929c13d3c92e848cddeb42b46b4981b7040ddd0a3e3d7a5ad61e07338d3e6284ddb77f7b86dc130ad42de6e8ef5c3d4255b83aa1298690388f79bef88a6d912
-
Filesize
88KB
MD59e89cca1dfea587d31166c97f87a6108
SHA19d0711ef54c0d1f9a3bd58050997a101efb5fe40
SHA256c47c19193fae76f52fd07e535445128a698985bcbe1a1962b6a4cee18aa970f5
SHA512e929c13d3c92e848cddeb42b46b4981b7040ddd0a3e3d7a5ad61e07338d3e6284ddb77f7b86dc130ad42de6e8ef5c3d4255b83aa1298690388f79bef88a6d912
-
Filesize
88KB
MD59e89cca1dfea587d31166c97f87a6108
SHA19d0711ef54c0d1f9a3bd58050997a101efb5fe40
SHA256c47c19193fae76f52fd07e535445128a698985bcbe1a1962b6a4cee18aa970f5
SHA512e929c13d3c92e848cddeb42b46b4981b7040ddd0a3e3d7a5ad61e07338d3e6284ddb77f7b86dc130ad42de6e8ef5c3d4255b83aa1298690388f79bef88a6d912