8f9a34842656bb5d15f2be00582723e641eb7d9208e3c34569108e4d8da34f00

General

Target

032ee518339bc35f1f173a29b105223a.exe
Size

232KB
MD5

032ee518339bc35f1f173a29b105223a
SHA1

3c0fe54528a768d1e22f14e0be4b2864c0911fd0
SHA256

8f9a34842656bb5d15f2be00582723e641eb7d9208e3c34569108e4d8da34f00
SHA512

f6baf47bbdab3a50476025edef78c0ba608e9ba9a758dce6368b73a590c387e721b53eba759a05ce9200e8b55c490131f11612eca1fefaae9ee9bd89c91a4761
SSDEEP

3072:dccx9+/Qwpvznz1NK/z1WdAwKh4aqosAm+wlO:qNz1NK/zEdBKh4aqosAm+w0

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	032ee518339bc35f1f173a29b105223a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cayag.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	032ee518339bc35f1f173a29b105223a.exe

Executes dropped EXE 1 IoCs

pid	Process
4448	cayag.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /g"	cayag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /y"	cayag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /x"	cayag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /u"	cayag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /f"	cayag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /v"	cayag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /c"	032ee518339bc35f1f173a29b105223a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /d"	cayag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /i"	cayag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /e"	cayag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cayag = "C:\\Users\\Admin\\cayag.exe /a"	cayag.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4672	032ee518339bc35f1f173a29b105223a.exe
4672	032ee518339bc35f1f173a29b105223a.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe
4448	cayag.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4672	032ee518339bc35f1f173a29b105223a.exe
4448	cayag.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4448	4672	032ee518339bc35f1f173a29b105223a.exe	91
PID 4672 wrote to memory of 4448	4672	032ee518339bc35f1f173a29b105223a.exe	91
PID 4672 wrote to memory of 4448	4672	032ee518339bc35f1f173a29b105223a.exe	91

C:\Users\Admin\AppData\Local\Temp\032ee518339bc35f1f173a29b105223a.exe
"C:\Users\Admin\AppData\Local\Temp\032ee518339bc35f1f173a29b105223a.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\cayag.exe
  "C:\Users\Admin\cayag.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4448