Analysis
-
max time kernel
169s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7088ef9c503b59d0f6486d5869b4a55.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7088ef9c503b59d0f6486d5869b4a55.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a7088ef9c503b59d0f6486d5869b4a55.exe
-
Size
220KB
-
MD5
a7088ef9c503b59d0f6486d5869b4a55
-
SHA1
8d23ff9437b35b5981ece8dea15c563b9879c6c0
-
SHA256
57cb21653d05d4f6a9a78f1d6aea98e768a567be26b5eea7e32d5ede7fc0eddd
-
SHA512
64bf17b5350987137f6221a4c5e5cc8af1709378c22374d7a6d1cfb52e6d7fc24d73721cd42beccf037f410df39cd718893046d86e87a238e8e5cb66024a7567
-
SSDEEP
3072:HfEFCI/HND3OafyT/v+r5nP398DFqIrOsyY6FyJU9KVpT:HWLOCyTX+r6FlrOsKc+9Kz
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a7088ef9c503b59d0f6486d5869b4a55.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" maumoa.exe -
Executes dropped EXE 1 IoCs
pid Process 2744 maumoa.exe -
Loads dropped DLL 2 IoCs
pid Process 1240 a7088ef9c503b59d0f6486d5869b4a55.exe 1240 a7088ef9c503b59d0f6486d5869b4a55.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /y" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /q" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /d" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /x" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /h" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /z" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /o" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /j" a7088ef9c503b59d0f6486d5869b4a55.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /e" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /n" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /p" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /w" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /m" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /s" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /r" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /u" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /v" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /i" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /b" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /l" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /a" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /j" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /g" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /f" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /t" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /k" maumoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\maumoa = "C:\\Users\\Admin\\maumoa.exe /c" maumoa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1240 a7088ef9c503b59d0f6486d5869b4a55.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe 2744 maumoa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1240 a7088ef9c503b59d0f6486d5869b4a55.exe 2744 maumoa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1240 wrote to memory of 2744 1240 a7088ef9c503b59d0f6486d5869b4a55.exe 27 PID 1240 wrote to memory of 2744 1240 a7088ef9c503b59d0f6486d5869b4a55.exe 27 PID 1240 wrote to memory of 2744 1240 a7088ef9c503b59d0f6486d5869b4a55.exe 27 PID 1240 wrote to memory of 2744 1240 a7088ef9c503b59d0f6486d5869b4a55.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7088ef9c503b59d0f6486d5869b4a55.exe"C:\Users\Admin\AppData\Local\Temp\a7088ef9c503b59d0f6486d5869b4a55.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\maumoa.exe"C:\Users\Admin\maumoa.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD5966bbd922e570ff8347dbc7d05fd8520
SHA1d5c326c5236c3346f3a1c9bf696312257ea50198
SHA2569357e131b69b78142e863a99179b9cc91b48cf1ca2c300954812aef58a79e98a
SHA5127a25610471ef307d5bb46c53712bae3bc3dba4cf0da4b5374ad00a8df839ecf0725a81046832ed70fa71bb98be5bb309d91b8bc26f3ef2b389906377269163fd