Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 16:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d757737b43a2b900873cd85dd64b4f3.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d757737b43a2b900873cd85dd64b4f3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2d757737b43a2b900873cd85dd64b4f3.exe
-
Size
260KB
-
MD5
2d757737b43a2b900873cd85dd64b4f3
-
SHA1
35efebd5b3a4e69333b0aec11858069a3875ffa7
-
SHA256
13f15263fa17c417ebc8edb24db4d4a61cc3be4aa088871f9542da97d7468cb2
-
SHA512
61ad9ffe05fb51e24aa824b652e1c77632c4922bca7e2d1749ee4c19cf599d1dbafb7e21f0f92764726797d362caebe70e11286b54e14c1041d55c158523e095
-
SSDEEP
3072:MgfAlNsvh25n/kZoSUjMqXnpWAkpAmTSrMaIOYt/jo7LAtPhjjtZnfHFEoWBfGV3:MdxgTSrMaIl/jcLijfHFEHWzXvjT85R
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wuoeyi.exe -
Executes dropped EXE 1 IoCs
pid Process 2084 wuoeyi.exe -
Loads dropped DLL 2 IoCs
pid Process 2220 2d757737b43a2b900873cd85dd64b4f3.exe 2220 2d757737b43a2b900873cd85dd64b4f3.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /t" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /y" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /l" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /h" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /C" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /u" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /L" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /W" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /s" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /N" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /U" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /D" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /M" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /Q" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /i" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /m" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /X" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /A" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /P" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /o" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /x" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /B" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /E" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /a" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /n" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /V" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /T" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /c" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /O" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /z" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /f" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /j" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /d" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /I" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /w" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /b" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /e" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /K" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /J" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /G" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /F" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /g" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /Z" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /p" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /q" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /R" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /H" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /Y" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /v" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /k" wuoeyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuoeyi = "C:\\Users\\Admin\\wuoeyi.exe /S" wuoeyi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe 2084 wuoeyi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2220 2d757737b43a2b900873cd85dd64b4f3.exe 2084 wuoeyi.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2084 2220 2d757737b43a2b900873cd85dd64b4f3.exe 28 PID 2220 wrote to memory of 2084 2220 2d757737b43a2b900873cd85dd64b4f3.exe 28 PID 2220 wrote to memory of 2084 2220 2d757737b43a2b900873cd85dd64b4f3.exe 28 PID 2220 wrote to memory of 2084 2220 2d757737b43a2b900873cd85dd64b4f3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d757737b43a2b900873cd85dd64b4f3.exe"C:\Users\Admin\AppData\Local\Temp\2d757737b43a2b900873cd85dd64b4f3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\wuoeyi.exe"C:\Users\Admin\wuoeyi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD5fabb0ec8d8187a540ac63f125f9e876d
SHA17ddc051ff28fd98b9895d567ba74f4b9ecea6b82
SHA256ef15b5def5c45074a86dbba986b98fcfc6d81946479f7c3ac86f19f711cc9aa4
SHA51279d12018a2f85639fab133bb525812dc68a18e008e8ab0d65b35a38544ba056f32e03884e8441c3bdd625559a322174bdec47117378ed4262b06fad20cd4402d
-
Filesize
252KB
MD5d6152def1d36d617bb736af8e02a4ca2
SHA1c50de8e904991a59aa5cd67e1ab859610b830493
SHA2569994d81e793affc390a5da5cd38460244188649b0ce5170d80a80e750fd2c702
SHA512703baa66134b0a9e54be735136a0d98d60e859e504c33dee00d2a1015fa174cba5ff04ab7984f428a77d10818f7b1fc65b74b539d79b361a800cf820882df8be
-
Filesize
260KB
MD59ac693f42b3ce6e079680b82ca88590d
SHA1a8638b56e249817cd4476264969f27a0e28e15eb
SHA2569083588aa8c952f9ba2d4e8bb192dbf9a92371e0aeea819b8301d46d2295c754
SHA5123b47502ab74553e8242ca5fb2040f1c041c15ccb025cddb97b12738046e0741ef4cbf93835da33cb37dc6b2de7321cfc5b3bcf4ae78aeb8f79ad5292ce0d7d6e
-
Filesize
52KB
MD57dacaba3bed7bc2da6e21578c6787838
SHA1d33ea69e26937347cf80cd87719eaacaa360b5de
SHA256dcb99674f6398d04e0d30110e6fca4b9baf8088275d78f2b1b616ba0715121b1
SHA51236787fa6dea8979df5fcb67c958b9d340285d5f4f6df658c5ff0f39fbf2e150b6252859f1e7757fd3dd110d55b81c8ec228e4a049c23064d627bbec7bb6038fa