3676825e4fe3d14869bbee01c8072e5c240fbea7a38f8468ce742a1b78ecdd10

Analysis

max time kernel
3s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fd8f5a44ee62a9616f5851eea2d3a2f.exe
Size

240KB
MD5

0fd8f5a44ee62a9616f5851eea2d3a2f
SHA1

b338b4ce025704e3efe4684c0264d672fd64b252
SHA256

3676825e4fe3d14869bbee01c8072e5c240fbea7a38f8468ce742a1b78ecdd10
SHA512

4a9e8c1ca955e9b9269ec89625ef48e9e9f9ebbd26929590d6dba2125dd9cd2d1b3c434512bd114ef436abb6587cb2b448ce4979d373fa79269275f27a831c84
SSDEEP

3072:7kNrT8j6VlpvBd90i/SmWKLi7CjFSivnfu3fbMdozt5czH36:7E0UGKGkFRKfeoztOu

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0fd8f5a44ee62a9616f5851eea2d3a2f.exe

Executes dropped EXE 1 IoCs

pid	Process
2384	cieacom.exe

Loads dropped DLL 2 IoCs

pid	Process
2104	0fd8f5a44ee62a9616f5851eea2d3a2f.exe
2104	0fd8f5a44ee62a9616f5851eea2d3a2f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\cieacom = "C:\\Users\\Admin\\cieacom.exe /c"	0fd8f5a44ee62a9616f5851eea2d3a2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2104	0fd8f5a44ee62a9616f5851eea2d3a2f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2104	0fd8f5a44ee62a9616f5851eea2d3a2f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2384	2104	0fd8f5a44ee62a9616f5851eea2d3a2f.exe	28
PID 2104 wrote to memory of 2384	2104	0fd8f5a44ee62a9616f5851eea2d3a2f.exe	28
PID 2104 wrote to memory of 2384	2104	0fd8f5a44ee62a9616f5851eea2d3a2f.exe	28
PID 2104 wrote to memory of 2384	2104	0fd8f5a44ee62a9616f5851eea2d3a2f.exe	28

C:\Users\Admin\AppData\Local\Temp\0fd8f5a44ee62a9616f5851eea2d3a2f.exe
"C:\Users\Admin\AppData\Local\Temp\0fd8f5a44ee62a9616f5851eea2d3a2f.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\cieacom.exe
  "C:\Users\Admin\cieacom.exe"
  2⤵
  - Executes dropped EXE
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\cieacom.exe

Filesize
178KB

MD5
d652e3902ca917c610eb5d71173904e7

SHA1
fee0f2a0c46e913e12d13ac9331c0a402a7ccc6f

SHA256
4b5bcfccbf7e5659db1c7d811c0297e0baabd6de3ac9d6268886997eb22bd055

SHA512
13e3c296103ce8070418b4316b39de2faf451a316d0ad1ae208b8ae0aada4caa32b625cf4c63cd2fff639a56d9c09322e90734a13a7c5ae18a3098e56ed99a38

Download Submit
\Users\Admin\cieacom.exe

Filesize
8KB

MD5
7039f061f0e5c3dfea5c0692ba31bb63

SHA1
54977243cafb2215c3ad199976e245f1c9fc2a7c

SHA256
9e639a7c43e703e4d2c177338d8342a614f4a5a36266a52d7b2d6ee655897117

SHA512
e84d6e48f5228ec4bf93d6bce1b2876b2d92b977308d74f5c8ff6b0380fdc2d24f86d8bb9d043b5d11579178cd8f5de5d113e8dd47fadbd8d9dd5f5e563d4cb4

Download Submit
\Users\Admin\cieacom.exe

Filesize
32KB

MD5
4dd3123837f3cd19c221cf5e734b61d3

SHA1
a18d7731b014dd54f66bd2834b1fab61503c10d3

SHA256
6c7fa854b04e837c26b5981e40d5ca4c271cff0b071765cce408e4a29f984099

SHA512
3a6f063b739575709582818adb851afd0072b0778f5e34c02325562a1f571f402b618cc5f5f1cc22cf97c5316479d583b9a15d0a6698061bda6d8953b15f5d8f

Download Submit