Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a601d0f3c9489f0fcafb2e745ee3687.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a601d0f3c9489f0fcafb2e745ee3687.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0a601d0f3c9489f0fcafb2e745ee3687.exe
-
Size
84KB
-
MD5
0a601d0f3c9489f0fcafb2e745ee3687
-
SHA1
7338d3ff773cfc7a49d73dabb79515c4dd61942a
-
SHA256
02e7b50f01aeb7753ed04ef92daf0a52153e862a3d82760ff00830659fd9cf90
-
SHA512
586a0042670070b8726b548564a94af85f4729a95be99582b39d6431e5016da13f3a3c2b2e4eff689118c7c9e1b4001c8fae55553c2db4ff21218c8d670cedeb
-
SSDEEP
768:p0Oglemuec4OdJNUC1x2avPPpykILkGuIBLP3nxD7TONoap55VSFJ0T72mZCcLX:pPglnZOdUCJwVuYipwFJ0T72mocT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0a601d0f3c9489f0fcafb2e745ee3687.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nuaotit.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 0a601d0f3c9489f0fcafb2e745ee3687.exe -
Executes dropped EXE 1 IoCs
pid Process 2352 nuaotit.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /v" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /s" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /a" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /q" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /l" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /w" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /h" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /n" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /f" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /c" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /d" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /i" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /x" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /u" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /p" 0a601d0f3c9489f0fcafb2e745ee3687.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /k" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /y" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /z" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /o" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /g" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /m" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /j" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /t" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /b" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /r" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /p" nuaotit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuaotit = "C:\\Users\\Admin\\nuaotit.exe /e" nuaotit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 492 0a601d0f3c9489f0fcafb2e745ee3687.exe 492 0a601d0f3c9489f0fcafb2e745ee3687.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe 2352 nuaotit.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 492 0a601d0f3c9489f0fcafb2e745ee3687.exe 2352 nuaotit.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 492 wrote to memory of 2352 492 0a601d0f3c9489f0fcafb2e745ee3687.exe 91 PID 492 wrote to memory of 2352 492 0a601d0f3c9489f0fcafb2e745ee3687.exe 91 PID 492 wrote to memory of 2352 492 0a601d0f3c9489f0fcafb2e745ee3687.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a601d0f3c9489f0fcafb2e745ee3687.exe"C:\Users\Admin\AppData\Local\Temp\0a601d0f3c9489f0fcafb2e745ee3687.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\nuaotit.exe"C:\Users\Admin\nuaotit.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD576eb81a5046216cf003c26beeb039279
SHA1eee8273bd379c49676d61ab794cc7a4f78745800
SHA25619dc14fb2dc81b12ee3d8390b79270724094f48b21403d1e79f31d22ccbae3ba
SHA5122afe6e8aa3d345ab6dc086707e2abe7a3f2188bf414db26108c4beb9c14e9cabc0e1ccb759393fcd993c327ed0452b2cb915fe341e5ab1abb982e704cd52a327
-
Filesize
84KB
MD5b8ba2a0dd3c29295fff38285d1173cf7
SHA101a95fa759799ca890d671aa94dc879df561bb8b
SHA256a825b1d04bf8670f79162f199006e2faea1c5489b21b8a592cf74ea7a180b334
SHA51224c23f639090f3cdee2be8e9f9b539a14ef6febac33f21efe1b3923b14db1e74f0d376dea19b870480334cee2ba36e55b58f42d988afa4b0842a13c763ee9c3d