Analysis
-
max time kernel
151s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 14:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
254b2689b075095ffa49da2f115f736b.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
254b2689b075095ffa49da2f115f736b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
254b2689b075095ffa49da2f115f736b.exe
-
Size
296KB
-
MD5
254b2689b075095ffa49da2f115f736b
-
SHA1
0c76aab3f9be0f1440c95f7a2f563407e29b91ee
-
SHA256
682f6caf63fd6e5bd13d8775e81a0f7e8a219b008e0840742d0b77b47f80e3a5
-
SHA512
fa71920465ed06a2c3c27d3403bad2d8aced19810eac62a7e8ea704242d06053fdf0fe146c4434dda9b45730634b0dba07a6922e97bfd39a92cb696012cdc650
-
SSDEEP
6144:wkFD1y0FXrKnvmb7/D26OJYPsMiqDJlJNwHG60Ja20EBb4jHX3QA/hwNGhWhThP1:wyD1y0F7Knvmb7/D265DJlJNwHG6sTbX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 254b2689b075095ffa49da2f115f736b.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" foeuyu.exe -
Executes dropped EXE 1 IoCs
pid Process 2296 foeuyu.exe -
Loads dropped DLL 2 IoCs
pid Process 1940 254b2689b075095ffa49da2f115f736b.exe 1940 254b2689b075095ffa49da2f115f736b.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /g" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /U" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /v" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /M" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /q" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /N" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /y" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /G" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /T" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /l" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /k" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /K" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /O" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /J" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /w" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /o" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /u" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /D" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /i" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /X" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /a" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /P" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /e" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /A" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /z" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /L" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /n" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /h" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /f" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /r" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /F" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /R" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /C" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /d" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /Z" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /c" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /Q" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /H" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /V" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /I" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /b" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /t" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /x" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /Y" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /w" 254b2689b075095ffa49da2f115f736b.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /B" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /m" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /j" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /W" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /p" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /E" foeuyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuyu = "C:\\Users\\Admin\\foeuyu.exe /s" foeuyu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 254b2689b075095ffa49da2f115f736b.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe 2296 foeuyu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1940 254b2689b075095ffa49da2f115f736b.exe 2296 foeuyu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2296 1940 254b2689b075095ffa49da2f115f736b.exe 28 PID 1940 wrote to memory of 2296 1940 254b2689b075095ffa49da2f115f736b.exe 28 PID 1940 wrote to memory of 2296 1940 254b2689b075095ffa49da2f115f736b.exe 28 PID 1940 wrote to memory of 2296 1940 254b2689b075095ffa49da2f115f736b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\254b2689b075095ffa49da2f115f736b.exe"C:\Users\Admin\AppData\Local\Temp\254b2689b075095ffa49da2f115f736b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\foeuyu.exe"C:\Users\Admin\foeuyu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD5a61b386120a7a0b1e01dabc1c40c1b1b
SHA1380423c9015c3a621778af4bf72068733f07c6a1
SHA256edbe8c18c0fc60983c1ad30e782d3918dc521a6e5c7fff0d74306a3d5feb61d5
SHA512bac8a91d34d922840d614a1832d286773f81ec13474167992cc655ffafcd23f538139edd9a7e852073d5f883afbf5fb92bc648ab17235ddce9dd2d973cbad9c1