Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04f4a1d86b2de3abeef0a6ad17553d0a.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
04f4a1d86b2de3abeef0a6ad17553d0a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
04f4a1d86b2de3abeef0a6ad17553d0a.exe
-
Size
96KB
-
MD5
04f4a1d86b2de3abeef0a6ad17553d0a
-
SHA1
7576ef887427b4a223446fbb9fc556e90515163a
-
SHA256
381b8e1e90e20d658ae7acea40bbcbe8dd1f93007b245a7127d72bd5ab5d52b7
-
SHA512
cca4f09a7eff5ce689f3c60544002e4c107ea8b19455850cedcbfae9430988820185db99d012c59f9da868082c95d8d8a6b06949d4015151981122fea2675492
-
SSDEEP
1536:4ceSb9Tj8Q89H1UbLSLeocTzFJ0T72VpIc:1tj4eBTzFJ0T728c
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 04f4a1d86b2de3abeef0a6ad17553d0a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" taaaxo.exe -
Executes dropped EXE 1 IoCs
pid Process 2740 taaaxo.exe -
Loads dropped DLL 2 IoCs
pid Process 284 04f4a1d86b2de3abeef0a6ad17553d0a.exe 284 04f4a1d86b2de3abeef0a6ad17553d0a.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /f" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /r" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /q" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /u" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /m" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /a" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /w" 04f4a1d86b2de3abeef0a6ad17553d0a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /x" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /z" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /n" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /c" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /e" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /v" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /o" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /w" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /l" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /j" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /b" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /s" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /i" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /d" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /g" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /h" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /t" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /p" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /y" taaaxo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\taaaxo = "C:\\Users\\Admin\\taaaxo.exe /k" taaaxo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 284 04f4a1d86b2de3abeef0a6ad17553d0a.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe 2740 taaaxo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 284 04f4a1d86b2de3abeef0a6ad17553d0a.exe 2740 taaaxo.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 284 wrote to memory of 2740 284 04f4a1d86b2de3abeef0a6ad17553d0a.exe 28 PID 284 wrote to memory of 2740 284 04f4a1d86b2de3abeef0a6ad17553d0a.exe 28 PID 284 wrote to memory of 2740 284 04f4a1d86b2de3abeef0a6ad17553d0a.exe 28 PID 284 wrote to memory of 2740 284 04f4a1d86b2de3abeef0a6ad17553d0a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\04f4a1d86b2de3abeef0a6ad17553d0a.exe"C:\Users\Admin\AppData\Local\Temp\04f4a1d86b2de3abeef0a6ad17553d0a.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Users\Admin\taaaxo.exe"C:\Users\Admin\taaaxo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5aaefd0e9f3c9ddc9ed77dfbd42f5aa4b
SHA1da529a1c855feee4848e028c1a2f703bee941c26
SHA25691962056760d494816c538cfe6df46b0f4fba8e4c8f9fe261893dc5c89919c25
SHA512a597b77819716ce44f2645029a84e58e637f87f39f64d27f80279929252073f68f82ca848280d8423f172d03f48f82ffa9acbfc4a837dc41f834d8a538be75a5