Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75a850e148c8d976cdb86366dafd55e1.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
75a850e148c8d976cdb86366dafd55e1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
75a850e148c8d976cdb86366dafd55e1.exe
-
Size
232KB
-
MD5
75a850e148c8d976cdb86366dafd55e1
-
SHA1
3d403e4ce1828180040d1ff83ff3b4d993498a83
-
SHA256
38f130d0b28383af6a3f1ee3b4d61d9ebd23613e851c5462d497aa15ed24a9d4
-
SHA512
a6ccb0884165ea7104d57cc6d094f50a7f5926b8dc68fb0567b68a40cb6b5f49b4a78bf75752fc7018a90c23e83125e5bcfb62a04e9bc5eb43762a81861e8538
-
SSDEEP
6144:Ny1q3PFKs78vpRTlEqxF6snji81RUinKbLv:zPhp
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 75a850e148c8d976cdb86366dafd55e1.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tuenae.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 75a850e148c8d976cdb86366dafd55e1.exe -
Executes dropped EXE 1 IoCs
pid Process 1436 tuenae.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /a" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /y" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /j" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /d" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /f" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /e" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /l" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /x" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /p" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /o" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /k" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /g" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /u" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /s" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /r" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /b" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /i" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /t" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /v" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /z" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /h" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /w" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /m" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /q" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /h" 75a850e148c8d976cdb86366dafd55e1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /n" tuenae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuenae = "C:\\Users\\Admin\\tuenae.exe /c" tuenae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4756 75a850e148c8d976cdb86366dafd55e1.exe 4756 75a850e148c8d976cdb86366dafd55e1.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe 1436 tuenae.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4756 75a850e148c8d976cdb86366dafd55e1.exe 1436 tuenae.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4756 wrote to memory of 1436 4756 75a850e148c8d976cdb86366dafd55e1.exe 93 PID 4756 wrote to memory of 1436 4756 75a850e148c8d976cdb86366dafd55e1.exe 93 PID 4756 wrote to memory of 1436 4756 75a850e148c8d976cdb86366dafd55e1.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\75a850e148c8d976cdb86366dafd55e1.exe"C:\Users\Admin\AppData\Local\Temp\75a850e148c8d976cdb86366dafd55e1.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\tuenae.exe"C:\Users\Admin\tuenae.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD5437c266f61dc07d04c739248692b7081
SHA1932e51d4e729e5020299014d68ae026ac3618a9f
SHA2568549e801c97b3f7b8ed1aaae54c093bb1bd9043ae502aa7d62b038e6ba57d325
SHA512e5c691f0be53534d34ae0a1bb40cca675b39498400a044cd91d198bd0f498dc0f1c4aa8f7da191e36366111911cd70dae7d7cbae4443f6f2f33a1982bb55ee7e