Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01b300eed1a720f8a74c346613e255b3.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
01b300eed1a720f8a74c346613e255b3.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
01b300eed1a720f8a74c346613e255b3.exe
-
Size
296KB
-
MD5
01b300eed1a720f8a74c346613e255b3
-
SHA1
52584fbfb3d381dc459f64ec7336d6a240dc6e19
-
SHA256
990a1f95e18d340e8755bd0f78626d7acb9324982b7eb92d318d7e2ed3a25122
-
SHA512
a72f788da52bf7e719840eac21ddb6afd4cde286e35f1ee607a3a2ef720f153cbc6e865f0ceec7702555d98be97950dde37a77e736ca04115f39d95303b93a59
-
SSDEEP
3072:AyeeHazh7sAFEouHwbBAW4hXNzcd6HFfak/K4jaU3bxK25M:Athz/FEouH+BAi4HFfAgLju
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 01b300eed1a720f8a74c346613e255b3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rdyuuv.exe -
Executes dropped EXE 1 IoCs
pid Process 3060 rdyuuv.exe -
Loads dropped DLL 2 IoCs
pid Process 2024 01b300eed1a720f8a74c346613e255b3.exe 2024 01b300eed1a720f8a74c346613e255b3.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /b" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /p" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /e" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /K" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /c" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /f" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /X" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /u" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /J" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /W" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /O" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /H" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /v" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /h" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /x" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /z" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /a" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /t" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /C" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /G" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /A" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /E" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /g" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /Z" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /U" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /i" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /q" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /V" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /k" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /F" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /m" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /P" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /o" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /I" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /w" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /Q" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /d" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /Y" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /R" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /n" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /r" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /N" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /S" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /l" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /P" 01b300eed1a720f8a74c346613e255b3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /L" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /M" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /B" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /j" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /s" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /y" rdyuuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdyuuv = "C:\\Users\\Admin\\rdyuuv.exe /D" rdyuuv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2024 01b300eed1a720f8a74c346613e255b3.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe 3060 rdyuuv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2024 01b300eed1a720f8a74c346613e255b3.exe 3060 rdyuuv.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2024 wrote to memory of 3060 2024 01b300eed1a720f8a74c346613e255b3.exe 28 PID 2024 wrote to memory of 3060 2024 01b300eed1a720f8a74c346613e255b3.exe 28 PID 2024 wrote to memory of 3060 2024 01b300eed1a720f8a74c346613e255b3.exe 28 PID 2024 wrote to memory of 3060 2024 01b300eed1a720f8a74c346613e255b3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\01b300eed1a720f8a74c346613e255b3.exe"C:\Users\Admin\AppData\Local\Temp\01b300eed1a720f8a74c346613e255b3.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\rdyuuv.exe"C:\Users\Admin\rdyuuv.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225KB
MD59e6830765627c6363c3fb8224c36cc6f
SHA1f33bde0f27c60d9d0e31d150fa196d3a7999450f
SHA2566073251b133c1c4b3d9a07cd89bb2cb25dd537beb12cc699ac4885d5e596d641
SHA51231ebc9b4ed9d1ddebd24b1c70d15981850d1004c0c8332a554a2370d1ac0f1a5d95cb112a2b865d34751a49244a44ffae118720b8ee17318d0c2635dc62315bb
-
Filesize
237KB
MD5241051d0d928f23f101f3fd2a182522f
SHA1efbd0a19ea5f262059069d70fe7b3e75b290d3e7
SHA256e6482c582fad86f5beca671491db46468af048f2992b4034ea38eba49d521edf
SHA512e4ce4d99099e57f0b661536468e9ead96f13bd52bcccb95253c2e0786df0ab56a08bf263ca7198670585ad8d7189270764afffb8cbf31ff2783c5af11dfb7953
-
Filesize
200KB
MD5ddb4bdec819d6adc0540cdd92285331a
SHA16bb3c6b9709301e7230a50d41229340720d9cd66
SHA256e4174aa7af2990367c3821224c8d9c44a8e8116a1dbe7afc4a242255882336e6
SHA5124e5852a60ec764bda2ed3b0c9e65cab9d619a1888f1b0dd46f586bd89eb867ac654b1507c222fbb3c455004e99ea4bd104a8831ed519b82c7ccaf11a80884a2f
-
Filesize
296KB
MD528a2bf6f20b2ee9cbf44e0ae829f5df1
SHA18749ae60afa422ce0838c3e0269091affcdbeb69
SHA25616cad7bfab2150575c08aeb8fac654eec8a777fdda26f30d9ec3dfffa39f9465
SHA512cf6e88b49aa13fac859feff651298090a8847150f71f18effad836edcdb3bf69b71b2fb9016d5debd2b2b95d6e87983861b4dd678a7fa19782b5afba6f4a56a7
-
Filesize
184KB
MD5ae94d3dd55bc88401c48e9e3b59be219
SHA131520d11def9f6ca9d137092a2589df9aabb27ca
SHA256734db4a03be3c0141260b0e04712ba1dce2da7511202f88999724158d1f6873b
SHA5129004b8651db96980606157d0bab03ed61d924ba0b8ae045189851b3d59ddcc69f0644edc34479a2879ff823d070c7b37daa78ecce7c3be622a83b1a714a17682