Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c1c93c5b062822511d5c77bd148a34c.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c1c93c5b062822511d5c77bd148a34c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
0c1c93c5b062822511d5c77bd148a34c.exe
-
Size
108KB
-
MD5
0c1c93c5b062822511d5c77bd148a34c
-
SHA1
96ab3cb4a9fc7d3fbd873efe9657c5cd5194d1a9
-
SHA256
50a7ef4ea08cffa20d73c86dc3294f08057f9e885c7bc0c8e8274dc48ef8ff5f
-
SHA512
8d69ecacbd4678d98f02b211001a1fab2d6a8fd2c2494883d911840824b0b661bfd02921edc614d5cae18016106dc9e24f966e387112c4d82087a59eb68ffccc
-
SSDEEP
1536:UOqzj0We+nBx3Of6ZcnWWG1KdIvf1ijij+p4j9S2fbwg7h4HVQJZp:IXeaBlOf2WG1KdrQN+Kp
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0c1c93c5b062822511d5c77bd148a34c.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" laakij.exe -
Executes dropped EXE 1 IoCs
pid Process 2704 laakij.exe -
Loads dropped DLL 2 IoCs
pid Process 2672 0c1c93c5b062822511d5c77bd148a34c.exe 2672 0c1c93c5b062822511d5c77bd148a34c.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /l" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /e" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /s" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /x" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /p" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /q" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /d" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /j" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /a" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /f" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /v" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /h" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /m" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /c" 0c1c93c5b062822511d5c77bd148a34c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /n" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /z" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /r" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /g" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /i" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /u" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /b" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /w" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /c" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /y" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /o" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /k" laakij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\laakij = "C:\\Users\\Admin\\laakij.exe /t" laakij.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2672 0c1c93c5b062822511d5c77bd148a34c.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe 2704 laakij.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2672 0c1c93c5b062822511d5c77bd148a34c.exe 2704 laakij.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2704 2672 0c1c93c5b062822511d5c77bd148a34c.exe 28 PID 2672 wrote to memory of 2704 2672 0c1c93c5b062822511d5c77bd148a34c.exe 28 PID 2672 wrote to memory of 2704 2672 0c1c93c5b062822511d5c77bd148a34c.exe 28 PID 2672 wrote to memory of 2704 2672 0c1c93c5b062822511d5c77bd148a34c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c1c93c5b062822511d5c77bd148a34c.exe"C:\Users\Admin\AppData\Local\Temp\0c1c93c5b062822511d5c77bd148a34c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\laakij.exe"C:\Users\Admin\laakij.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD543caed72c9ff68e3b67f2f2f614b5520
SHA196b4d04ec7451a66ab8a385418200a472a674480
SHA256d82b5f49692cdb88cfece3c9129686455ed41d82eab7ca825155785c742ed6c1
SHA512e99527f648a26798994135ee342864d60fb02347180e18a8bf9896dddcf557062cfce502fdd6af6f91ff69096731643808c9efdf5b8887dabbcfd62841e489dc