Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1414899745a51fbc4a944b94d98d788b.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1414899745a51fbc4a944b94d98d788b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1414899745a51fbc4a944b94d98d788b.exe
-
Size
244KB
-
MD5
1414899745a51fbc4a944b94d98d788b
-
SHA1
6423e1703f3bc46d480b1422be3c5fb1c82cc683
-
SHA256
0da7f3696f6be0d279ea7b27a096d411bb24624c6bdfff94cba505c96be9715e
-
SHA512
c9099cb72264ec1b30e3810797013c9e47b1b9df952fc30137d2b39d192ca80277a8d7a0f085ec5dd51e32dff649de0233fe3bd4b0f745de67538794bcdda0fb
-
SSDEEP
6144:J5Es5EzPLrs7CZIQtVpoY85spRMWLwDE3C5gn9OD4u9Xb:J5EsALiC2QtVpoU3dyL
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" laora.exe -
Executes dropped EXE 1 IoCs
pid Process 2452 laora.exe -
Loads dropped DLL 2 IoCs
pid Process 1196 1414899745a51fbc4a944b94d98d788b.exe 1196 1414899745a51fbc4a944b94d98d788b.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /l" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /R" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /Q" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /O" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /j" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /E" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /H" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /v" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /p" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /Z" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /S" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /D" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /u" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /r" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /M" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /P" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /a" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /X" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /x" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /V" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /g" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /b" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /n" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /J" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /T" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /L" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /z" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /h" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /c" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /w" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /t" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /W" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /i" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /K" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /m" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /y" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /s" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /Y" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /I" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /A" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /C" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /B" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /e" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /q" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /f" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /o" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /U" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /N" laora.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\laora = "C:\\Users\\Admin\\laora.exe /G" laora.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe 2452 laora.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1196 1414899745a51fbc4a944b94d98d788b.exe 2452 laora.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1196 wrote to memory of 2452 1196 1414899745a51fbc4a944b94d98d788b.exe 28 PID 1196 wrote to memory of 2452 1196 1414899745a51fbc4a944b94d98d788b.exe 28 PID 1196 wrote to memory of 2452 1196 1414899745a51fbc4a944b94d98d788b.exe 28 PID 1196 wrote to memory of 2452 1196 1414899745a51fbc4a944b94d98d788b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1414899745a51fbc4a944b94d98d788b.exe"C:\Users\Admin\AppData\Local\Temp\1414899745a51fbc4a944b94d98d788b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\laora.exe"C:\Users\Admin\laora.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5410446bad5a5b8db5ea2d60bee92ddcd
SHA15fcf0fb8b5d68ac2eeb3346a0e6c292ec371e48d
SHA256018c2481424c34f65f6e7e0bbf641e86053fd6fdad94816f244cc93bc431a9cb
SHA512f2e6f0e56008db3536e2a392b722bba982e697b38c72ffc1dc307c6987060accc484d9268dab324fac9a01b80a6a1c3f84c6bfca62910b3e79bf4559ebc19dce
-
Filesize
56KB
MD5677f55810f429fda8b8e910d5ea1be9a
SHA1af15f749c38c5a484ef609765d091cb4039f0674
SHA2569e22f001974a07a6668aaa1d71ab2a1185ac9705488a571d8d8ff9fa01d5a463
SHA512a262b837b6628f5069041ede757618e1cda41cdc456cbb4b7ca54d98c98d07614288d65b045c59984e3c9f178d191d6e8cda0d18e60b5899d2febd7c9104060b
-
Filesize
92KB
MD5cf2560ad41663b7c7805ead4b30e350f
SHA11493d40fdb87fb5861ab77a3a93539b073947fac
SHA256312edee00b964da9e3d9bb3eafb25c2d2d3fadb5fd99bc2b0d2006919c82eaa4
SHA5128adda11846c6bd8c71f27a15e53d1b83bf1b73879ea2f2c4adc088e12a7a54fae2357a41bb5a9c22cf8d95fb577355571adf4abc03a58d68fd9ef4d5cda59465
-
Filesize
151KB
MD584487c7a357bce839858eb6f9abeae86
SHA114a3513237814241c1727d505819ac0c224072f6
SHA256d616f38e60c7d5263623898c0cdba31a028f3d92a47005cd952b11ef3217db23
SHA512cd85c29da26021e3d14f1d1095bd8165f564954441a7d5092eb8448345c1c1ed6ed609ef52631b23871604c9de692955ef732b12356615d26ed2e6aa5b5b1f51
-
Filesize
90KB
MD563960d1a68a21c4039eaf24dbc303278
SHA129176e23d0d64bb26bf9607de3e115351005bcb8
SHA256a6c81031a35a1df9eef3a443cde212a47274d13806ef7f73e64c668e543a6ad4
SHA512cf065e216e996a145ed859db827e4a8d134beab844c36714d94a32ec793f796da4fb1c890f7bb9bc7aaf6c4ec43d275f6d178edf37a27c2ff99dec6c0620b028