Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2022, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe
-
Size
128KB
-
MD5
3854e27aeaa78f6e89afe9fb8ff549c9
-
SHA1
e64d25a982649504c12588d7a2444a5b92b12d11
-
SHA256
1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9
-
SHA512
6fd4c5dca8388afaeb52132075f2a927152678ea289d335775a56caecc53cb16616a7729013ee4fccd2d49760ff4986b2084779c7989f166de5cfb7e517bedc0
-
SSDEEP
768:d1/Hda9ST28Xe04H7cHPHYmug6UXQm1dIZE2ocOT77e:dzqFHyj6S3T77
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duecuf.exe -
Executes dropped EXE 1 IoCs
pid Process 3856 duecuf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ duecuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duecuf = "C:\\Users\\Admin\\duecuf.exe" duecuf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe 3856 duecuf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1436 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 3856 duecuf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1436 wrote to memory of 3856 1436 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 79 PID 1436 wrote to memory of 3856 1436 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 79 PID 1436 wrote to memory of 3856 1436 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 79 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78 PID 3856 wrote to memory of 1436 3856 duecuf.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe"C:\Users\Admin\AppData\Local\Temp\1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\duecuf.exe"C:\Users\Admin\duecuf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD54f2c4444da031df1384961f44182ef13
SHA160b29a8a7e3aa227b199975dd42b01961b87fe0d
SHA256075d8366ee9646012ddcae822f331a1856650353ea0bfe6e6e0b19bc3f182242
SHA512a881e7643ed7826f8f9b842e1e80f928c188338f1b7215fd7afb9138c55e0699a408d04540224c169a29c5b4b5cf5bb8cfb721136173a17ad5f78339990b5881
-
Filesize
128KB
MD54f2c4444da031df1384961f44182ef13
SHA160b29a8a7e3aa227b199975dd42b01961b87fe0d
SHA256075d8366ee9646012ddcae822f331a1856650353ea0bfe6e6e0b19bc3f182242
SHA512a881e7643ed7826f8f9b842e1e80f928c188338f1b7215fd7afb9138c55e0699a408d04540224c169a29c5b4b5cf5bb8cfb721136173a17ad5f78339990b5881