Analysis
-
max time kernel
206s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ef51f0c0ea5094b7424ae72329514eb.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ef51f0c0ea5094b7424ae72329514eb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1ef51f0c0ea5094b7424ae72329514eb.exe
-
Size
316KB
-
MD5
1ef51f0c0ea5094b7424ae72329514eb
-
SHA1
93f3b87887b13d5471c322e25713ac0d643b5784
-
SHA256
36e29d98d912ce7667179378e29c7b555d7710b5caa8271a41b5af86c88db955
-
SHA512
8af172605cc371f4e94e0be341248caa69a55e241f1c7d0b3038842bf3a728c6fac1e1bad23f54192900a8e1c40535e5e26cc085fdffff43217284918a114fb9
-
SSDEEP
6144:s/JVYOhyCTEtWff9nQMdkxIV0OQotoBOm8ntGUcF6/DsEfNXqkEL+:eJVYOR9YxIToYmtyIx+
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1ef51f0c0ea5094b7424ae72329514eb.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" buuem.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 1ef51f0c0ea5094b7424ae72329514eb.exe -
Executes dropped EXE 1 IoCs
pid Process 2784 buuem.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /g" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /W" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /v" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /q" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /C" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /w" 1ef51f0c0ea5094b7424ae72329514eb.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /N" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /s" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /Z" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /U" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /i" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /K" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /x" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /E" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /G" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /n" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /I" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /t" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /J" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /u" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /T" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /D" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /e" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /l" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /X" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /A" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /Q" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /p" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /V" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /k" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /d" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /a" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /S" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /c" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /m" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /j" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /z" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /M" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /H" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /B" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /F" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /w" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /h" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /O" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /o" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /r" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /y" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /Y" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /b" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /P" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /R" buuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuem = "C:\\Users\\Admin\\buuem.exe /L" buuem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2404 1ef51f0c0ea5094b7424ae72329514eb.exe 2404 1ef51f0c0ea5094b7424ae72329514eb.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe 2784 buuem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2404 1ef51f0c0ea5094b7424ae72329514eb.exe 2784 buuem.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2784 2404 1ef51f0c0ea5094b7424ae72329514eb.exe 94 PID 2404 wrote to memory of 2784 2404 1ef51f0c0ea5094b7424ae72329514eb.exe 94 PID 2404 wrote to memory of 2784 2404 1ef51f0c0ea5094b7424ae72329514eb.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ef51f0c0ea5094b7424ae72329514eb.exe"C:\Users\Admin\AppData\Local\Temp\1ef51f0c0ea5094b7424ae72329514eb.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\buuem.exe"C:\Users\Admin\buuem.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD51fac6828acf5cadd8e13ff75da8ef0b3
SHA14c387fbdae3cf323b6db5b3f3fef56ce39afee2b
SHA25636bca745d80bceaa601ed9fff13acfc42bd00de281582dcf69a080bbc71aa9e6
SHA512645555a47c10b6d6f73ab64c285b935185b2399138ce3d936ae3c55e634dd91e0272f3373656cc3b5f9538beef76b8a0ffaf6710a2730af9119550fcac962a9f