Analysis
-
max time kernel
152s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 01:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
097f5a8c833e5d40ff30dedcc4017d76.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
097f5a8c833e5d40ff30dedcc4017d76.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
097f5a8c833e5d40ff30dedcc4017d76.exe
-
Size
312KB
-
MD5
097f5a8c833e5d40ff30dedcc4017d76
-
SHA1
3ca87f2da0c32c16b6c1e78cfc906518e2c60e98
-
SHA256
51b88e6a5b0eec8a43e8a9203ccb9e7c31ab4eeaafab363b080f1688f88b2482
-
SHA512
8762b755a88558c7dff20dbac8d39b30504353c3dca3443641c7908b6056bb5c992508f7aef1c982851601ea403a65fed7c322a4acc1adf99d5e31ef2937a566
-
SSDEEP
6144:zlKErvTlIpr1f+XqO5pOmS6FRb6OyLPmUQFJ:x7TlIB1f+551vsPmUQFJ
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 097f5a8c833e5d40ff30dedcc4017d76.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" veiim.exe -
Executes dropped EXE 1 IoCs
pid Process 2832 veiim.exe -
Loads dropped DLL 2 IoCs
pid Process 2772 097f5a8c833e5d40ff30dedcc4017d76.exe 2772 097f5a8c833e5d40ff30dedcc4017d76.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /w" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /n" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /r" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /c" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /k" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /h" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /t" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /u" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /s" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /y" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /a" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /l" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /o" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /z" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /v" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /i" 097f5a8c833e5d40ff30dedcc4017d76.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /g" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /x" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /b" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /m" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /j" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /f" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /d" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /q" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /p" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /e" veiim.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiim = "C:\\Users\\Admin\\veiim.exe /i" veiim.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2772 097f5a8c833e5d40ff30dedcc4017d76.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe 2832 veiim.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2772 097f5a8c833e5d40ff30dedcc4017d76.exe 2832 veiim.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2832 2772 097f5a8c833e5d40ff30dedcc4017d76.exe 28 PID 2772 wrote to memory of 2832 2772 097f5a8c833e5d40ff30dedcc4017d76.exe 28 PID 2772 wrote to memory of 2832 2772 097f5a8c833e5d40ff30dedcc4017d76.exe 28 PID 2772 wrote to memory of 2832 2772 097f5a8c833e5d40ff30dedcc4017d76.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\097f5a8c833e5d40ff30dedcc4017d76.exe"C:\Users\Admin\AppData\Local\Temp\097f5a8c833e5d40ff30dedcc4017d76.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\veiim.exe"C:\Users\Admin\veiim.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD5fb9aee368f3261c27555621497d5a48c
SHA13c62bbf8b6f4463a4d10e17ac0c0b7a8bedb7a9f
SHA2566121696c7e11fc52426bf6708510e4d89764325aabb69abd1155fd04a1f52db2
SHA5123a3d4353480e68545f7360e725595c1493991fd6f192cc5b6499af25e2b14f3ffff0576a8bb5e353e9e8dbb10c5dcf71849b45d281101441b719a586acde3246