Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 03:10
Static task
static1
Behavioral task
behavioral1
Sample
ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe
-
Size
228KB
-
MD5
802c46e73f5b0dd1452e5a2618e6578f
-
SHA1
a87a7cad77d2d466867289d37ca14b801ee04e46
-
SHA256
ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4
-
SHA512
33c46e82f697735b276a959777f4abd1bf8569dd976171e53adb201f067d5ef692233020b67b0acd9d4dfd8ef9196601c5e1e3dfa13eb363ec89db13ce7fda5a
-
SSDEEP
6144:Qmk3PFKs7aFwKWwalhrEqxF6snji81RUinKZHg/7SW:QmePhAmZIH+7f
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" naioze.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe -
Executes dropped EXE 1 IoCs
pid Process 1324 naioze.exe -
Loads dropped DLL 2 IoCs
pid Process 1504 ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe 1504 ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /v" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /g" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /b" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /q" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /p" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /x" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /k" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /j" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /m" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /t" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /z" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /y" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /o" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /n" naioze.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /s" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /l" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /f" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /u" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /h" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /i" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /c" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /e" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /d" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /a" naioze.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /c" ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /r" naioze.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\naioze = "C:\\Users\\Admin\\naioze.exe /w" naioze.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1504 ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe 1324 naioze.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1504 ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe 1324 naioze.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1324 1504 ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe 26 PID 1504 wrote to memory of 1324 1504 ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe 26 PID 1504 wrote to memory of 1324 1504 ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe 26 PID 1504 wrote to memory of 1324 1504 ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe"C:\Users\Admin\AppData\Local\Temp\ef3229448695b67a4fc8f89c713ce80c122b207b08250f87440ebb10373b45b4.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\naioze.exe"C:\Users\Admin\naioze.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1324
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD52b5b66906f15de879c56376dfe2e66b7
SHA13daf0e3dd0e9fb8ca7a33efe6723760c5edcff7b
SHA256270a513038c71733236be7d753fda9f02b12b1a107dfe69d86ee236ee97da9d4
SHA5124d0101928c98eccf28b1c394ee059a63d902e2ebd3b7e2f3f9169c2e9cd72fe0d53cd612736a0d24e8138f856e93af1364eeab1ec28b00ab514d5a1a66bd63e9
-
Filesize
228KB
MD52b5b66906f15de879c56376dfe2e66b7
SHA13daf0e3dd0e9fb8ca7a33efe6723760c5edcff7b
SHA256270a513038c71733236be7d753fda9f02b12b1a107dfe69d86ee236ee97da9d4
SHA5124d0101928c98eccf28b1c394ee059a63d902e2ebd3b7e2f3f9169c2e9cd72fe0d53cd612736a0d24e8138f856e93af1364eeab1ec28b00ab514d5a1a66bd63e9
-
Filesize
228KB
MD52b5b66906f15de879c56376dfe2e66b7
SHA13daf0e3dd0e9fb8ca7a33efe6723760c5edcff7b
SHA256270a513038c71733236be7d753fda9f02b12b1a107dfe69d86ee236ee97da9d4
SHA5124d0101928c98eccf28b1c394ee059a63d902e2ebd3b7e2f3f9169c2e9cd72fe0d53cd612736a0d24e8138f856e93af1364eeab1ec28b00ab514d5a1a66bd63e9
-
Filesize
228KB
MD52b5b66906f15de879c56376dfe2e66b7
SHA13daf0e3dd0e9fb8ca7a33efe6723760c5edcff7b
SHA256270a513038c71733236be7d753fda9f02b12b1a107dfe69d86ee236ee97da9d4
SHA5124d0101928c98eccf28b1c394ee059a63d902e2ebd3b7e2f3f9169c2e9cd72fe0d53cd612736a0d24e8138f856e93af1364eeab1ec28b00ab514d5a1a66bd63e9