Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
a9cd04e2d97fc0954dbbf279ed59d0ca.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a9cd04e2d97fc0954dbbf279ed59d0ca.exe
Resource
win10v2004-20231215-en
General
-
Target
a9cd04e2d97fc0954dbbf279ed59d0ca.exe
-
Size
180KB
-
MD5
a9cd04e2d97fc0954dbbf279ed59d0ca
-
SHA1
c61f2904f591cd66d01e9948c4ee7f5ae30f7ad3
-
SHA256
6c9f98c6af1ac1a565627ddfd2abc7e7fdc42f65e5f8892babd53d3930fdfa93
-
SHA512
ccf1b0bf6b93a70181531546f411b7b9f285fd932e9d272e1788ed679e144548c1f74ba052cdfa7469df54f719d2986a93c3e75ad3674c71450419c552a616f2
-
SSDEEP
3072:JIOGdYRLoeEdRos/eaqFnqWDb+uTyLDC6s5sSYqGlC6YViZj5HQXZmmJ0yCFioxr:W3cKPpm2lC6YViZj5HQXZmmJ0yCF9Bxx
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a9cd04e2d97fc0954dbbf279ed59d0ca.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" diiugej.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation a9cd04e2d97fc0954dbbf279ed59d0ca.exe -
Executes dropped EXE 1 IoCs
pid Process 1656 diiugej.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /R" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /P" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /X" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /d" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /o" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /k" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /S" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /y" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /C" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /j" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /e" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /F" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /p" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /r" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /J" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /E" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /l" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /B" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /f" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /U" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /i" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /v" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /a" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /n" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /W" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /M" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /D" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /A" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /T" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /t" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /b" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /g" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /H" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /Q" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /L" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /G" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /w" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /Y" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /I" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /s" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /h" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /Z" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /N" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /C" a9cd04e2d97fc0954dbbf279ed59d0ca.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /z" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /O" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /x" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /m" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /c" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /V" diiugej.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diiugej = "C:\\Users\\Admin\\diiugej.exe /q" diiugej.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3160 a9cd04e2d97fc0954dbbf279ed59d0ca.exe 3160 a9cd04e2d97fc0954dbbf279ed59d0ca.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe 1656 diiugej.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3160 a9cd04e2d97fc0954dbbf279ed59d0ca.exe 1656 diiugej.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3160 wrote to memory of 1656 3160 a9cd04e2d97fc0954dbbf279ed59d0ca.exe 92 PID 3160 wrote to memory of 1656 3160 a9cd04e2d97fc0954dbbf279ed59d0ca.exe 92 PID 3160 wrote to memory of 1656 3160 a9cd04e2d97fc0954dbbf279ed59d0ca.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9cd04e2d97fc0954dbbf279ed59d0ca.exe"C:\Users\Admin\AppData\Local\Temp\a9cd04e2d97fc0954dbbf279ed59d0ca.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\diiugej.exe"C:\Users\Admin\diiugej.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5f2b4fd2d9af25794aa2f7eacd2ef5a9e
SHA1e148f8dd05986e7705c76441cecec5321425b229
SHA256e3c8968c83ed8eee6068c06c308ab5dfe8134df075bb7802f07ec00e86694bd3
SHA512bcca4f38184a548c6f0336f5dd789bd6fc517bf526b5174dc59a3e7058bbf3be9445aa29426252532ce0f04612d418178ce5e3818c16cc593f25989320dc2cbc