Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 21:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51b97a98b2394e66650577477ce63156.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
51b97a98b2394e66650577477ce63156.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
51b97a98b2394e66650577477ce63156.exe
-
Size
196KB
-
MD5
51b97a98b2394e66650577477ce63156
-
SHA1
aa3914c4e50f03ea29f6b72c5820515271a6f634
-
SHA256
cb93ec8a8c66c0b6297ebdc2c237b29b109b3aefbe21656999ea74eff124b0be
-
SHA512
a165b039fef9e207ebf17f16ecb6ebe22f1e7c2ac3bb662a3a47c3c47367e247df778712c404e983df10923b9a1ddcb13930546153a559c0de731ba61a8d709a
-
SSDEEP
3072:Jg0vVnPybzV8Q3io0ce4LTI208YioBK9QRO8qeXQ:JrvVnPybzV8Oio0ctLTt08doLRO8qeg
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sueed.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 51b97a98b2394e66650577477ce63156.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 51b97a98b2394e66650577477ce63156.exe -
Executes dropped EXE 1 IoCs
pid Process 4592 sueed.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /j" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /d" 51b97a98b2394e66650577477ce63156.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /I" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /k" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /T" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /H" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /u" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /A" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /m" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /O" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /P" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /B" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /y" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /t" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /d" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /v" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /p" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /x" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /D" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /F" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /Q" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /l" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /L" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /w" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /f" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /o" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /h" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /W" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /N" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /n" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /e" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /J" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /S" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /i" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /g" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /M" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /s" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /q" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /b" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /Y" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /z" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /V" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /U" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /Z" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /X" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /C" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /G" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /E" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /R" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /K" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /a" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /r" sueed.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sueed = "C:\\Users\\Admin\\sueed.exe /c" sueed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2140 51b97a98b2394e66650577477ce63156.exe 2140 51b97a98b2394e66650577477ce63156.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe 4592 sueed.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2140 51b97a98b2394e66650577477ce63156.exe 4592 sueed.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2140 wrote to memory of 4592 2140 51b97a98b2394e66650577477ce63156.exe 90 PID 2140 wrote to memory of 4592 2140 51b97a98b2394e66650577477ce63156.exe 90 PID 2140 wrote to memory of 4592 2140 51b97a98b2394e66650577477ce63156.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\51b97a98b2394e66650577477ce63156.exe"C:\Users\Admin\AppData\Local\Temp\51b97a98b2394e66650577477ce63156.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\sueed.exe"C:\Users\Admin\sueed.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5dd6bc5ae9b6dd2a146596dec3904371c
SHA12fe491002d7332526f3c41b5c40535e5e6058923
SHA2562a875b9a70e25dec71f75ecb8ce553dac5a9f7c502c3661d65f5d292d4c56f68
SHA512d47b2310e19496685272dad772e01074cdf53d70824d5425f93d378401b0ce787f49ff48bb21533900830c054635ceb4001c7e64f4a64442e92569d14d6d242a