7ceb8249254c0d29e440aa47d3304df9fbce2b097fd370ad7dcdac5f31fdd14d

Analysis

max time kernel
158s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cedb41d45c24fd93f70ff4dedb2c242.exe
Size

124KB
MD5

1cedb41d45c24fd93f70ff4dedb2c242
SHA1

398ea1ba5c50a1884e9f2569df8421aa0230156b
SHA256

7ceb8249254c0d29e440aa47d3304df9fbce2b097fd370ad7dcdac5f31fdd14d
SHA512

aba4a66e069fc9512a7c6b5a9141ee26817c9a716b2a96ce35823c8b3a5f499a0481964d399426af7dae5c93ac6e5d4438e5fae59ed89686074cabf378c5bce4
SSDEEP

1536:d+J9pTAgU0GgAYu0P1kNmwldCMhdu8KWP/nTn8nBP9VeUrNeG0h/o:m9pkgU0GgA89xkg

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1cedb41d45c24fd93f70ff4dedb2c242.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hoage.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	1cedb41d45c24fd93f70ff4dedb2c242.exe

Executes dropped EXE 1 IoCs

pid	Process
1084	hoage.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /X"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /n"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /W"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /x"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /K"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /N"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /z"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /w"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /g"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /s"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /u"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /j"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /o"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /h"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /M"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /i"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /A"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /G"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /l"	1cedb41d45c24fd93f70ff4dedb2c242.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /v"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /R"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /I"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /c"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /C"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /F"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /y"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /b"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /f"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /J"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /Z"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /m"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /S"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /p"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /t"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /V"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /D"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /l"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /Y"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /E"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /a"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /H"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /r"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /P"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /e"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /U"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /d"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /Q"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /B"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /O"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /q"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /L"	hoage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoage = "C:\\Users\\Admin\\hoage.exe /T"	hoage.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3788	1cedb41d45c24fd93f70ff4dedb2c242.exe
3788	1cedb41d45c24fd93f70ff4dedb2c242.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe
1084	hoage.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3788	1cedb41d45c24fd93f70ff4dedb2c242.exe
1084	hoage.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 1084	3788	1cedb41d45c24fd93f70ff4dedb2c242.exe	92
PID 3788 wrote to memory of 1084	3788	1cedb41d45c24fd93f70ff4dedb2c242.exe	92
PID 3788 wrote to memory of 1084	3788	1cedb41d45c24fd93f70ff4dedb2c242.exe	92

C:\Users\Admin\AppData\Local\Temp\1cedb41d45c24fd93f70ff4dedb2c242.exe
"C:\Users\Admin\AppData\Local\Temp\1cedb41d45c24fd93f70ff4dedb2c242.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\hoage.exe
  "C:\Users\Admin\hoage.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\hoage.exe

Filesize
124KB

MD5
26899a08f48d9cb2e5296b18cac95bcc

SHA1
3906024b704f2cc18b255833d6a9479bf39f5a03

SHA256
d452e25ecbf60f2ae4c6a376c6f6a43bbb28d72236cc1a1142e02d0355bab219

SHA512
45c1651efa4641adb1d6ae2646a075ff7d4c39b5d57bdfed0dfd09da1dbac55f5357c04c353b1bf8b7caa49eba14e32826fddd867c89cca6967916d6fbe8818c

Download Submit