Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 09:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6274566c9076d2cd58822d4a39714783.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
6274566c9076d2cd58822d4a39714783.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
6274566c9076d2cd58822d4a39714783.exe
-
Size
208KB
-
MD5
6274566c9076d2cd58822d4a39714783
-
SHA1
ca58ad8a7dd37618fd085891f7afb9a8e463e4b8
-
SHA256
47c79f6c8765e5d5d87f6c48acb8cc5aa4f798743c4465931dd2fc0636227f1b
-
SHA512
743e1193766afdd1366412c9c353e0e75741070057c5fc365f2dc82e9cead0c07cf57e822609775d2deef38d0cec08551414bc5781e43cfd67eacc3df8b99697
-
SSDEEP
3072:sRPD2J+VwC/ZAUfdMEneski9Wjgxa9AC:B0hAyeskiUjP9AC
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6274566c9076d2cd58822d4a39714783.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ruooja.exe -
Executes dropped EXE 1 IoCs
pid Process 2264 ruooja.exe -
Loads dropped DLL 2 IoCs
pid Process 2212 6274566c9076d2cd58822d4a39714783.exe 2212 6274566c9076d2cd58822d4a39714783.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /o" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /j" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /r" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /t" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /n" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /x" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /q" 6274566c9076d2cd58822d4a39714783.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /u" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /b" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /z" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /m" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /w" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /e" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /f" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /i" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /q" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /s" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /v" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /h" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /k" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /g" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /d" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /a" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /l" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /y" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /c" ruooja.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruooja = "C:\\Users\\Admin\\ruooja.exe /p" ruooja.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 6274566c9076d2cd58822d4a39714783.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe 2264 ruooja.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2212 6274566c9076d2cd58822d4a39714783.exe 2264 ruooja.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2264 2212 6274566c9076d2cd58822d4a39714783.exe 28 PID 2212 wrote to memory of 2264 2212 6274566c9076d2cd58822d4a39714783.exe 28 PID 2212 wrote to memory of 2264 2212 6274566c9076d2cd58822d4a39714783.exe 28 PID 2212 wrote to memory of 2264 2212 6274566c9076d2cd58822d4a39714783.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6274566c9076d2cd58822d4a39714783.exe"C:\Users\Admin\AppData\Local\Temp\6274566c9076d2cd58822d4a39714783.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\ruooja.exe"C:\Users\Admin\ruooja.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5849606ba355504f11f18e68772c30f2a
SHA1579bf8d96ab2ed252c2f59658d6e24c83c54053b
SHA2561daee2baf3b15cc060b1d846d891fc8259697de6d4d3da07dad18451fe8a47f1
SHA5125bde88f882d615085221920504c29e74b14eb530b932268d71815256575b76087147d970bee1a8830128b2d4e9457f0e8edf200ef4dca53b906d7878627fc044