Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04f4a1d86b2de3abeef0a6ad17553d0a.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
04f4a1d86b2de3abeef0a6ad17553d0a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
04f4a1d86b2de3abeef0a6ad17553d0a.exe
-
Size
96KB
-
MD5
04f4a1d86b2de3abeef0a6ad17553d0a
-
SHA1
7576ef887427b4a223446fbb9fc556e90515163a
-
SHA256
381b8e1e90e20d658ae7acea40bbcbe8dd1f93007b245a7127d72bd5ab5d52b7
-
SHA512
cca4f09a7eff5ce689f3c60544002e4c107ea8b19455850cedcbfae9430988820185db99d012c59f9da868082c95d8d8a6b06949d4015151981122fea2675492
-
SSDEEP
1536:4ceSb9Tj8Q89H1UbLSLeocTzFJ0T72VpIc:1tj4eBTzFJ0T728c
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 04f4a1d86b2de3abeef0a6ad17553d0a.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" woaqo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 04f4a1d86b2de3abeef0a6ad17553d0a.exe -
Executes dropped EXE 1 IoCs
pid Process 2480 woaqo.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /w" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /k" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /u" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /v" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /t" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /z" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /a" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /n" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /y" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /o" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /d" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /c" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /p" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /x" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /b" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /e" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /s" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /h" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /m" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /z" 04f4a1d86b2de3abeef0a6ad17553d0a.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /i" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /r" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /g" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /f" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /l" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /q" woaqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaqo = "C:\\Users\\Admin\\woaqo.exe /j" woaqo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4732 04f4a1d86b2de3abeef0a6ad17553d0a.exe 4732 04f4a1d86b2de3abeef0a6ad17553d0a.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe 2480 woaqo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4732 04f4a1d86b2de3abeef0a6ad17553d0a.exe 2480 woaqo.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4732 wrote to memory of 2480 4732 04f4a1d86b2de3abeef0a6ad17553d0a.exe 97 PID 4732 wrote to memory of 2480 4732 04f4a1d86b2de3abeef0a6ad17553d0a.exe 97 PID 4732 wrote to memory of 2480 4732 04f4a1d86b2de3abeef0a6ad17553d0a.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\04f4a1d86b2de3abeef0a6ad17553d0a.exe"C:\Users\Admin\AppData\Local\Temp\04f4a1d86b2de3abeef0a6ad17553d0a.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\woaqo.exe"C:\Users\Admin\woaqo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5aa2f5425bfb3e1d83fb414962cc4c97a
SHA1723677683869c70f987632afa2a4eada6868fd8d
SHA256a1a27dae17b73616e35f785a6d25317e4bb25a5359950f2d0e8d11594e38405f
SHA51295220c7ec7a049c3d44539e199d227e15d7a9f9f7717693cccc9f3a356857d241eaa6da5746a15954f9cc96dfe541a94488e9eef15836cec29c3dce4ae955888
-
Filesize
1KB
MD52e2e95e13e3b793bfa79edf436c6bc90
SHA1c5a0f89bd546483d0351c187acbc3e55df246a24
SHA256066f999eb355444201cea9cabd010753431e0d92b7821cf7eaf5b2277b12e3ff
SHA5122474f228c85b761cff2379fa0de35fe79e0d00f2037dd8755285b4200fced76ccc0efc6ed892cb6304f31f6e4a3019baa34a9455d8347c1a394ec69d0b3a73d6