Analysis
-
max time kernel
152s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 16:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05414e9d0e637c5193a907cd6a6821bc.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
05414e9d0e637c5193a907cd6a6821bc.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
05414e9d0e637c5193a907cd6a6821bc.exe
-
Size
240KB
-
MD5
05414e9d0e637c5193a907cd6a6821bc
-
SHA1
8282429971f904b8919c3c4c6240a4cf3998b982
-
SHA256
48d5415a781c58fd3617da6edb8cf3add5210e7a14c6ca63839cdc83a350403d
-
SHA512
01789451f129fe466e30be13a67949fbaba4fafbecaa1012557565f6afc1d97c00df80d3244014cb1f3b6d7925c7138475e7596db34de54b766a3b72db1fc711
-
SSDEEP
6144:U77FThz+4OAY0kmg7JXKj4vxim1EHlXnJJIyMAf5W/SbDHeIuy0bQ:6rz+4OAY0kmg7JXKoyMAf5W/SbCIXW
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 05414e9d0e637c5193a907cd6a6821bc.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cpyeal.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 05414e9d0e637c5193a907cd6a6821bc.exe -
Executes dropped EXE 1 IoCs
pid Process 4936 cpyeal.exe -
Adds Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /x" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /m" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /o" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /e" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /u" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /y" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /k" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /a" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /g" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /s" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /r" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /d" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /w" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /n" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /v" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /j" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /h" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /i" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /i" 05414e9d0e637c5193a907cd6a6821bc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /p" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /l" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /z" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /b" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /c" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /t" cpyeal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpyeal = "C:\\Users\\Admin\\cpyeal.exe /f" cpyeal.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 05414e9d0e637c5193a907cd6a6821bc.exe 1940 05414e9d0e637c5193a907cd6a6821bc.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe 4936 cpyeal.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1940 05414e9d0e637c5193a907cd6a6821bc.exe 4936 cpyeal.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1940 wrote to memory of 4936 1940 05414e9d0e637c5193a907cd6a6821bc.exe 95 PID 1940 wrote to memory of 4936 1940 05414e9d0e637c5193a907cd6a6821bc.exe 95 PID 1940 wrote to memory of 4936 1940 05414e9d0e637c5193a907cd6a6821bc.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\05414e9d0e637c5193a907cd6a6821bc.exe"C:\Users\Admin\AppData\Local\Temp\05414e9d0e637c5193a907cd6a6821bc.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\cpyeal.exe"C:\Users\Admin\cpyeal.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5b0b9e9ea5947e2d3823c8d8e18724c21
SHA1f53c9d1fac87736fb2b9ddc3e03f90682f6baf5a
SHA256ddbcbebb4231be93355988b6cc978e485d76f24561c3d0b4e7e02c30ca147c63
SHA5124975562c2a44fa6ba780b0ba533e221b0ce373eee2273d2c2f140da010c0a598d8efea4e1b508be43aa0f95925ca86db74db211050365bc5eeb888a40a323587