Analysis
-
max time kernel
178s -
max time network
199s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4979d365f1279a84525cfaae1025b300.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4979d365f1279a84525cfaae1025b300.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4979d365f1279a84525cfaae1025b300.exe
-
Size
96KB
-
MD5
4979d365f1279a84525cfaae1025b300
-
SHA1
a05cabf1e2c23fab056bd4d183704f1d3f8b3390
-
SHA256
6e43743039352edff38845ad63e4e60bf9ea055cecda04d4dda5179edf6f8328
-
SHA512
c2dd9f41397064f0cb97b93551f5d0ed00a88cb66dd37e5f80ca831fa954de6ec65faa925930bd004af54f7c25cb58d5382faec38008f665cbe7921d86b6dc9a
-
SSDEEP
1536:2GBTozhgzWwmhLmncdkadGVScGYJXeiyCnO+TI4K4I4i404R4Z1VcvsJOpPpMm4S:dEzaW6cOadGRJuH7ut/Tdvd+hXV/vU3n
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kuidui.exe -
Executes dropped EXE 1 IoCs
pid Process 2620 kuidui.exe -
Loads dropped DLL 2 IoCs
pid Process 2816 4979d365f1279a84525cfaae1025b300.exe 2816 4979d365f1279a84525cfaae1025b300.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /s" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /Y" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /o" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /W" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /b" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /p" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /R" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /m" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /H" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /D" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /g" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /J" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /n" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /K" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /d" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /E" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /c" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /q" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /j" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /t" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /r" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /O" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /y" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /L" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /N" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /A" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /Q" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /C" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /P" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /e" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /X" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /F" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /V" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /Z" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /z" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /S" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /u" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /T" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /h" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /U" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /l" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /w" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /G" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /a" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /k" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /f" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /v" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /x" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /B" kuidui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuidui = "C:\\Users\\Admin\\kuidui.exe /I" kuidui.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe 2620 kuidui.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2816 4979d365f1279a84525cfaae1025b300.exe 2620 kuidui.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2620 2816 4979d365f1279a84525cfaae1025b300.exe 29 PID 2816 wrote to memory of 2620 2816 4979d365f1279a84525cfaae1025b300.exe 29 PID 2816 wrote to memory of 2620 2816 4979d365f1279a84525cfaae1025b300.exe 29 PID 2816 wrote to memory of 2620 2816 4979d365f1279a84525cfaae1025b300.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4979d365f1279a84525cfaae1025b300.exe"C:\Users\Admin\AppData\Local\Temp\4979d365f1279a84525cfaae1025b300.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\kuidui.exe"C:\Users\Admin\kuidui.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5c59d4e0bc634229583fe80fa1bd73e4c
SHA1131a87eb38d9e157c3fe54b311077b0be93ce95f
SHA256465a60302fe903ec5aa6cf136084ee5544f34ed50162da77bc4c7bfc9429ce4b
SHA512fcc163158c06b19a0cc1c1a86c871e3e164541fb92611600f9e84448df04df867099ff2bfbf2ff57b5e5a35a2f78d9edc17b082f1ead622ee119a8425ebcb53c