Analysis
-
max time kernel
187s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
279d538960cf507b8cd7924fd0951b07.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
279d538960cf507b8cd7924fd0951b07.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
279d538960cf507b8cd7924fd0951b07.exe
-
Size
188KB
-
MD5
279d538960cf507b8cd7924fd0951b07
-
SHA1
38b24a8aeb8e51dce76dbfe0172636a895b64c04
-
SHA256
7edbdd65a2ad7c0c5e497cf20d2fc2f5c6cb6b47917d62fc2d12886c90e58d7e
-
SHA512
a6ac51bd933e36c5b7b407290a25b944478a969938eb9ed3949f7f8de0657e399036266a5876390eaed5d506e1483b56eb70bcabe69f67d9f8dee87b6647f171
-
SSDEEP
3072:pzimg3VDdq4sNUbaxF6FFZ8i4aqosAm+w90Z0W:F4sY/Z8i4aqosAm+w90/
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 279d538960cf507b8cd7924fd0951b07.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hiibai.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 279d538960cf507b8cd7924fd0951b07.exe -
Executes dropped EXE 1 IoCs
pid Process 3900 hiibai.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /k" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /y" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /i" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /p" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /n" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /l" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /j" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /d" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /o" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /g" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /z" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /h" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /f" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /m" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /v" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /b" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /q" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /t" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /p" 279d538960cf507b8cd7924fd0951b07.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /c" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /s" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /r" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /u" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /w" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /x" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /e" hiibai.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiibai = "C:\\Users\\Admin\\hiibai.exe /a" hiibai.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4292 279d538960cf507b8cd7924fd0951b07.exe 4292 279d538960cf507b8cd7924fd0951b07.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe 3900 hiibai.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4292 279d538960cf507b8cd7924fd0951b07.exe 3900 hiibai.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4292 wrote to memory of 3900 4292 279d538960cf507b8cd7924fd0951b07.exe 90 PID 4292 wrote to memory of 3900 4292 279d538960cf507b8cd7924fd0951b07.exe 90 PID 4292 wrote to memory of 3900 4292 279d538960cf507b8cd7924fd0951b07.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\279d538960cf507b8cd7924fd0951b07.exe"C:\Users\Admin\AppData\Local\Temp\279d538960cf507b8cd7924fd0951b07.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\hiibai.exe"C:\Users\Admin\hiibai.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD537b53a6d5e0782920c630fded55d4fba
SHA14fb439375605b98662d762cbc3cdbc4bae6fadda
SHA256873fe516be2b1c4a96006534c16a14f0f7b51c8d467a6b9d8f5bb920bd784ff3
SHA5124f7a40e0e723ccdb3e12a3e34f26a7e10a5641a93680d8cd1eed750c3e1430449a80d00360c4bc09728ca597d4e2a6253171cbe66a5135dc4852f11c03b82b95