Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 02:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b539b0ea7ba4b59529d41275e8a97ee.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b539b0ea7ba4b59529d41275e8a97ee.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4b539b0ea7ba4b59529d41275e8a97ee.exe
-
Size
96KB
-
MD5
4b539b0ea7ba4b59529d41275e8a97ee
-
SHA1
975e1f67cefa0f0014b61392269a7b285abc835f
-
SHA256
43c9ee0e24b1f13015a3a6a4deb843d03d45b47d1ffdb7dc864f5d2188200f03
-
SHA512
5c192f1f81663320dfea5831cf438db3e69489068df3bbf3abaf9703ad985283eb69e1ebb4dc711f8b88dd3ac69f00fc6de84217d263a673276dea91fecd778f
-
SSDEEP
1536:2QPH+8MK1dGW3KuXDNSj6Jcv8gjhfFj2PzR/jG3qDP:NvqK3GUKAJgjw/nD
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meeawaf.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4b539b0ea7ba4b59529d41275e8a97ee.exe -
Executes dropped EXE 1 IoCs
pid Process 2708 meeawaf.exe -
Loads dropped DLL 2 IoCs
pid Process 2392 4b539b0ea7ba4b59529d41275e8a97ee.exe 2392 4b539b0ea7ba4b59529d41275e8a97ee.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /p" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /g" 4b539b0ea7ba4b59529d41275e8a97ee.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /q" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /r" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /v" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /i" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /j" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /f" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /a" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /h" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /d" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /c" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /b" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /w" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /x" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /s" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /u" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /m" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /y" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /k" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /l" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /z" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /e" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /t" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /n" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /o" meeawaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\meeawaf = "C:\\Users\\Admin\\meeawaf.exe /g" meeawaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2392 4b539b0ea7ba4b59529d41275e8a97ee.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe 2708 meeawaf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2392 4b539b0ea7ba4b59529d41275e8a97ee.exe 2708 meeawaf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2708 2392 4b539b0ea7ba4b59529d41275e8a97ee.exe 28 PID 2392 wrote to memory of 2708 2392 4b539b0ea7ba4b59529d41275e8a97ee.exe 28 PID 2392 wrote to memory of 2708 2392 4b539b0ea7ba4b59529d41275e8a97ee.exe 28 PID 2392 wrote to memory of 2708 2392 4b539b0ea7ba4b59529d41275e8a97ee.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b539b0ea7ba4b59529d41275e8a97ee.exe"C:\Users\Admin\AppData\Local\Temp\4b539b0ea7ba4b59529d41275e8a97ee.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\meeawaf.exe"C:\Users\Admin\meeawaf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD51b0f1267a553be88864b408901bd90f5
SHA19041de0c441989910538060f07167f0457a97334
SHA2567280a0ef7b1c6b11b4f52982fe0ece0857c15fcd474f28ac65188239b8970073
SHA5121b8297b618fd24411431ae797368e42e6e461ea4c8381cb1156010f9f8a446b8d75c831415045cec7a3eca172da680c86210adbedff59481f79f0508a583db89