d478d6dd237e22795b46ed1daa57b1968ec5d449e60e24cfed4e502549eca0b4

Analysis

max time kernel
99s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3485de720983163afe70bd0052dc1d68.exe
Size

72KB
MD5

3485de720983163afe70bd0052dc1d68
SHA1

dad5a8c76fc9039faeef4158f4fc081081fb33a1
SHA256

d478d6dd237e22795b46ed1daa57b1968ec5d449e60e24cfed4e502549eca0b4
SHA512

a9e40aca9404789f7b673a33a20b1af8cd4763cbc42ed61f1fbd04b6d2f407219ef3524f63a77dbf17f952d6f0cdfd0c5df56648f9aa05666286335e945b87d9
SSDEEP

768:hmmuiuFhFtI0bgiY7qDpGjW7/U/jSXuHQilKPMPC4VqrMZWXArffTeffUW7EBmAQ:hcFmw3kqDUWb0jOYC4VqrMZWXAWAdN4

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wofud.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	3485de720983163afe70bd0052dc1d68.exe

Executes dropped EXE 1 IoCs

pid	Process
4664	wofud.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wofud = "C:\\Users\\Admin\\wofud.exe"	wofud.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe
4664	wofud.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3636	3485de720983163afe70bd0052dc1d68.exe
4664	wofud.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 4664	3636	3485de720983163afe70bd0052dc1d68.exe	92
PID 3636 wrote to memory of 4664	3636	3485de720983163afe70bd0052dc1d68.exe	92
PID 3636 wrote to memory of 4664	3636	3485de720983163afe70bd0052dc1d68.exe	92
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88
PID 4664 wrote to memory of 3636	4664	wofud.exe	88

C:\Users\Admin\AppData\Local\Temp\3485de720983163afe70bd0052dc1d68.exe
"C:\Users\Admin\AppData\Local\Temp\3485de720983163afe70bd0052dc1d68.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\wofud.exe
  "C:\Users\Admin\wofud.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\wofud.exe

Filesize
72KB

MD5
026d2c25fbf9d861246ca2c626a5b2a1

SHA1
23b018cd2910b88178d48d2e86deed052c836832

SHA256
c75c08a06901c39b6f3df53ae91d85f8a73b96bd58073b3c33e0afb552db7216

SHA512
e8623d6fb88a5a0588b721d9f614c63559e2d0f094fa3ab3c14219deb4a2c71cf43fb4d66935068b300a81d49843cec877b3ab99769e0abbc86ddfd3b8dcc9ba

Download Submit