Analysis
-
max time kernel
198s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 11:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c5f8bf708bacefd644c4462a30fec95.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c5f8bf708bacefd644c4462a30fec95.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1c5f8bf708bacefd644c4462a30fec95.exe
-
Size
192KB
-
MD5
1c5f8bf708bacefd644c4462a30fec95
-
SHA1
3fde36c690e4b3c62a6ee106afdcb97c8c39ac8f
-
SHA256
29d3fee58324e89c3fcee9cac9fe9f31b01103ea23711eecda78eaa8c13a18b5
-
SHA512
7ff7508899e5d0f24d435eca1e0e7977a001d876754e5f3adbb6a656a113bb1fedf4b19aefc05cb19e7d90310ec5c93f9a4cb60b44789869c2895ff311cb76f1
-
SSDEEP
3072:YrZuCWv2JQcFBKBJy6apbuD2VMbj1hlUywqbo9hW:Y9BWvUFIJlapu2V21r/C8
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1c5f8bf708bacefd644c4462a30fec95.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baulaf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 1c5f8bf708bacefd644c4462a30fec95.exe -
Executes dropped EXE 1 IoCs
pid Process 440 baulaf.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /L" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /K" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /D" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /S" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /v" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /h" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /i" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /N" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /p" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /u" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /e" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /n" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /B" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /g" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /j" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /W" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /R" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /c" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /f" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /l" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /F" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /U" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /a" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /z" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /G" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /V" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /Y" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /I" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /x" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /b" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /q" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /P" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /m" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /o" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /k" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /g" 1c5f8bf708bacefd644c4462a30fec95.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /w" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /Z" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /X" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /C" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /r" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /H" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /y" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /M" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /t" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /A" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /T" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /J" baulaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baulaf = "C:\\Users\\Admin\\baulaf.exe /d" baulaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3592 1c5f8bf708bacefd644c4462a30fec95.exe 3592 1c5f8bf708bacefd644c4462a30fec95.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe 440 baulaf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3592 1c5f8bf708bacefd644c4462a30fec95.exe 440 baulaf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3592 wrote to memory of 440 3592 1c5f8bf708bacefd644c4462a30fec95.exe 93 PID 3592 wrote to memory of 440 3592 1c5f8bf708bacefd644c4462a30fec95.exe 93 PID 3592 wrote to memory of 440 3592 1c5f8bf708bacefd644c4462a30fec95.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c5f8bf708bacefd644c4462a30fec95.exe"C:\Users\Admin\AppData\Local\Temp\1c5f8bf708bacefd644c4462a30fec95.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\baulaf.exe"C:\Users\Admin\baulaf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD573fd882402f849a5756653561c9337a6
SHA14e3ac481abe5b739dbb5cf0a7cc96720afbc8e27
SHA2562fe20aff299d8e5ddf1f763ed180480575b3e2d95016fbccd831791e7c358660
SHA512aab73b80f6a2e743605c713e5dac6a69415cf762695b0ee77ba8c49327d51334a40298f0ad36308487f8c006c223b2102f395c6de1d9f5d1b5cce91f3e13b5ad