Analysis
-
max time kernel
58s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
043d8def8d9c9d603b5a6320b4e8a9e6.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
043d8def8d9c9d603b5a6320b4e8a9e6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
043d8def8d9c9d603b5a6320b4e8a9e6.exe
-
Size
292KB
-
MD5
043d8def8d9c9d603b5a6320b4e8a9e6
-
SHA1
69c0b167a82e148f27ec35208230232204581d32
-
SHA256
19cac766fac463a947302ab28b35cbd479b4d293340833b23fce34faf048b45d
-
SHA512
654e9e2c442d058b0716388c6426079d1790824239abb125a1c806717a39b2007ed999906d19daacc785943e2eda5bbc71bb5355c6747ffe29bb17b69cf3f252
-
SSDEEP
6144:m6f0iLlxjqNeVilscsU3ESMCjtpUABR6YLzSv79VxUutl:fXLlx2kViuUPMCjtpUABR6YLzo7RUy
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 043d8def8d9c9d603b5a6320b4e8a9e6.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dgjuij.exe -
Executes dropped EXE 1 IoCs
pid Process 2932 dgjuij.exe -
Loads dropped DLL 2 IoCs
pid Process 3012 043d8def8d9c9d603b5a6320b4e8a9e6.exe 3012 043d8def8d9c9d603b5a6320b4e8a9e6.exe -
Adds Run key to start application 2 TTPs 44 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /F" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /n" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /z" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /t" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /L" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /o" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /g" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /Q" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /I" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /W" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /u" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /R" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /T" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /D" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /O" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /i" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /l" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /S" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /p" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /U" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /y" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /x" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /d" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /X" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /E" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /s" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /v" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /J" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /j" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /h" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /b" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /Y" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /M" 043d8def8d9c9d603b5a6320b4e8a9e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /m" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /w" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /C" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /H" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /r" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /K" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /a" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /N" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /Z" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /M" dgjuij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dgjuij = "C:\\Users\\Admin\\dgjuij.exe /q" dgjuij.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3012 043d8def8d9c9d603b5a6320b4e8a9e6.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe 2932 dgjuij.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3012 043d8def8d9c9d603b5a6320b4e8a9e6.exe 2932 dgjuij.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2932 3012 043d8def8d9c9d603b5a6320b4e8a9e6.exe 29 PID 3012 wrote to memory of 2932 3012 043d8def8d9c9d603b5a6320b4e8a9e6.exe 29 PID 3012 wrote to memory of 2932 3012 043d8def8d9c9d603b5a6320b4e8a9e6.exe 29 PID 3012 wrote to memory of 2932 3012 043d8def8d9c9d603b5a6320b4e8a9e6.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\043d8def8d9c9d603b5a6320b4e8a9e6.exe"C:\Users\Admin\AppData\Local\Temp\043d8def8d9c9d603b5a6320b4e8a9e6.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\dgjuij.exe"C:\Users\Admin\dgjuij.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
292KB
MD5031a15f6d9aa2dfc86addf8a06eaa4fa
SHA187d411f533ddb4b6445e32ab27848b1dd413d6e9
SHA256b744a982be352f2c0093aff54180cb53b8717b4f5244630dfdaf1a893135506f
SHA5129f3c81770501bdcdacede217aefb9175b89dac76c64c52f0c444a43a46b0d39bf32eb0a181017686504104d378c2c238927b00ce21ad631ee7adb77468ba2872