Analysis
- max time kernel
156s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
07/01/2024, 19:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
492e7d6747013b67630122f49cf3464c.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
492e7d6747013b67630122f49cf3464c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 492e7d6747013b67630122f49cf3464c.exe
- Size 216KB
- Sample240107-xznwasdbd4
- SHA256 79f908bf59620e9f095763555676dcc42d9dd703841bf667a68c913f8a5a1664
- MD5 492e7d6747013b67630122f49cf3464c
- SHA1 4a359fdf3bf92c39c9ee89e36d206cafc1ea0f45
- SHA512 a0bc1196ec232ffeefa9b0e6950f18d46f2790cffee2811fe6dde22226ae7dbd0f281492e68c8a72cd7e64528d5bf93f491b051265b6027266754fcf97beb896
- SSDEEP 6144:f4/oDdJzpTlbwEhYKFIGuhtFaA6Tuyrj:fpFJ+IIGusduy
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zueafa.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 492e7d6747013b67630122f49cf3464c.exe - Executes dropped EXE 1 IoCs
pid Process 2408 zueafa.exe - Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /C" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /b" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /n" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /e" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /q" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /B" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /r" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /G" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /Y" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /W" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /Z" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /Q" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /a" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /V" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /t" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /R" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /F" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /H" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /o" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /L" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /x" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /I" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /s" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /p" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /y" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /m" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /E" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /X" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /c" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /T" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /J" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /z" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /h" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /M" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /N" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /j" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /U" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /d" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /O" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /k" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /f" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /l" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /A" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /D" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /w" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /v" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /i" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /S" zueafa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zueafa = "C:\\Users\\Admin\\zueafa.exe /P" zueafa.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe 2408 zueafa.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1192 492e7d6747013b67630122f49cf3464c.exe 2408 zueafa.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1192 wrote to memory of 2408 1192 492e7d6747013b67630122f49cf3464c.exe 94 PID 1192 wrote to memory of 2408 1192 492e7d6747013b67630122f49cf3464c.exe 94 PID 1192 wrote to memory of 2408 1192 492e7d6747013b67630122f49cf3464c.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\492e7d6747013b67630122f49cf3464c.exe"C:\Users\Admin\AppData\Local\Temp\492e7d6747013b67630122f49cf3464c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\zueafa.exe"C:\Users\Admin\zueafa.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2408
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\zueafa.exe
- Size 216KB
- SHA256 c1148890bc9a2c844eb4974b6cd88ff1bf6253bfa49485c3376f0dc2543492fa
- MD5 69ca9b91bb8efce9adc78aceda8dcda8
- SHA1 1438dabc761ca701d80e9a635740c80f98131cf7
- SHA512 2e4e99d52c81ac9b17e7c22048b46b2cd96060af18cc292dd581175dea129689014b29f600c0c2ee72c8d341583cf26eec67c5feab40f61feccbd149dadea81c
- SSDEEP 6144:f4TioDdJzpTlbwEhYKFIGuhtFaA6Tuyrj:fiFFJ+IIGusduy
- MD5 SHA1 SHA512 SSDEEP