Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 20:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
030372cf501ce4b666bd911751c5e691.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
030372cf501ce4b666bd911751c5e691.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
030372cf501ce4b666bd911751c5e691.exe
-
Size
180KB
-
MD5
030372cf501ce4b666bd911751c5e691
-
SHA1
77c0b2711f082160e6a3fcb0e8817a2f87b60825
-
SHA256
ace9b3c59c29dc16cad3a7c62ee5315bd7f2cc6a20bb512846649bf6fe8bfa97
-
SHA512
4d1f8dd342d9b0f77119b23a5b466a040f211f2693d77d45d2b403ea629f486abbd43053532106816cb8185a208c4e4136e31943b6a9013fd07ff6a2b42dff50
-
SSDEEP
3072:T/iu7ehhNrWlAIJqPYNbihKovbAM4VkRvjCKuz3EwBT3edZlSL6aOuTOunpE7bVT:L5uhNrWlAIJqPYNbihRzrNvjITEeedZL
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 030372cf501ce4b666bd911751c5e691.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" boono.exe -
Executes dropped EXE 1 IoCs
pid Process 2436 boono.exe -
Loads dropped DLL 2 IoCs
pid Process 2656 030372cf501ce4b666bd911751c5e691.exe 2656 030372cf501ce4b666bd911751c5e691.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /s" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /m" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /r" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /c" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /Y" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /a" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /O" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /H" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /M" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /l" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /x" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /f" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /d" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /g" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /V" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /q" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /j" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /G" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /r" 030372cf501ce4b666bd911751c5e691.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /b" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /e" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /z" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /E" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /L" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /i" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /w" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /T" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /N" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /I" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /y" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /J" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /v" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /F" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /X" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /B" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /u" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /Q" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /C" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /k" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /t" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /S" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /o" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /p" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /Z" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /W" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /n" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /P" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /U" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /K" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /R" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /A" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /h" boono.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\boono = "C:\\Users\\Admin\\boono.exe /D" boono.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2656 030372cf501ce4b666bd911751c5e691.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe 2436 boono.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2656 030372cf501ce4b666bd911751c5e691.exe 2436 boono.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2436 2656 030372cf501ce4b666bd911751c5e691.exe 28 PID 2656 wrote to memory of 2436 2656 030372cf501ce4b666bd911751c5e691.exe 28 PID 2656 wrote to memory of 2436 2656 030372cf501ce4b666bd911751c5e691.exe 28 PID 2656 wrote to memory of 2436 2656 030372cf501ce4b666bd911751c5e691.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\030372cf501ce4b666bd911751c5e691.exe"C:\Users\Admin\AppData\Local\Temp\030372cf501ce4b666bd911751c5e691.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\boono.exe"C:\Users\Admin\boono.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD548c5d3361b75a28ca1d9210469eafc31
SHA16844fd7856c9604704a488a0619ebb20eb354c20
SHA256e0facfc44338b214c7ec71b81db4d5690558650f285da5696d0a948da846985e
SHA51295a3048bc4ea6acb5033beff0694b029a6e00c8cd77aca03fc7a586138a70142875b827e2900167ecdd7756512544f449b39ba4fc69040de24e4fbe1269acb11