Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 14:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76f76dc660cf93607e3976a688c0f728.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
76f76dc660cf93607e3976a688c0f728.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
76f76dc660cf93607e3976a688c0f728.exe
-
Size
228KB
-
MD5
76f76dc660cf93607e3976a688c0f728
-
SHA1
d9cc836ec7e704093d1d5d52e7f913448325d723
-
SHA256
17a4434249498fdc019316964d05d75c23e03400ef00869433b4febf13362677
-
SHA512
cf10cacc53f5cd44e18cf0460779d8b4f31590df0ed2ab23b05123a89cd6a77b223d98b97b27cf5e9bf105e42e7f97cd2cbebe01c4896e2b0cd601b3edf7ca8b
-
SSDEEP
6144:Jmgw3PFKs7aFwKWwalhrEqxF6snji81RUinKZHg/7So:JmJPhAmZIH+7d
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 76f76dc660cf93607e3976a688c0f728.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mueod.exe -
Executes dropped EXE 1 IoCs
pid Process 1980 mueod.exe -
Loads dropped DLL 2 IoCs
pid Process 1888 76f76dc660cf93607e3976a688c0f728.exe 1888 76f76dc660cf93607e3976a688c0f728.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /c" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /o" 76f76dc660cf93607e3976a688c0f728.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /x" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /a" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /g" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /r" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /t" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /q" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /i" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /f" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /v" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /d" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /w" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /e" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /u" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /s" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /m" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /h" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /y" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /b" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /p" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /o" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /j" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /k" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /l" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /z" mueod.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mueod = "C:\\Users\\Admin\\mueod.exe /n" mueod.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1888 76f76dc660cf93607e3976a688c0f728.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe 1980 mueod.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1888 76f76dc660cf93607e3976a688c0f728.exe 1980 mueod.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1980 1888 76f76dc660cf93607e3976a688c0f728.exe 28 PID 1888 wrote to memory of 1980 1888 76f76dc660cf93607e3976a688c0f728.exe 28 PID 1888 wrote to memory of 1980 1888 76f76dc660cf93607e3976a688c0f728.exe 28 PID 1888 wrote to memory of 1980 1888 76f76dc660cf93607e3976a688c0f728.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\76f76dc660cf93607e3976a688c0f728.exe"C:\Users\Admin\AppData\Local\Temp\76f76dc660cf93607e3976a688c0f728.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\mueod.exe"C:\Users\Admin\mueod.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5f6c21d532881cb1db0fedabe0813ae92
SHA1dae05e52e2575f1a73e727bb67a83a03d101e732
SHA256058af644c309a300e28b9a10d0cf9bb3d6a20fa725e462b0d482afa5470f7517
SHA512a0ee5886aef3ba74d328a68abb80a99385d01fd72d5d1aa35450393847573bb291d2de4e844f695229396b508593406e085d6b9f3707c098380235f1416c29d9