Analysis
-
max time kernel
163s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2024 06:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55b057826c77fb6c5047483f06fbf880.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
55b057826c77fb6c5047483f06fbf880.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
55b057826c77fb6c5047483f06fbf880.exe
-
Size
140KB
-
MD5
55b057826c77fb6c5047483f06fbf880
-
SHA1
0b13e6ce4daf9ce79bd6bc3791bd911dfa8b8d94
-
SHA256
818e842d42e2307de9058ece6260313eea686665a4663d607d952503facb1ecf
-
SHA512
99a3f94dda9724b4bf22016e1d2adc5b5dcc269aead522f15aeea18a5d5e2ff728098bf0da9dae3ae8783e34991358310ea34cd4bc4feaf0b37e8160bc974d29
-
SSDEEP
768:zevsmyt4pd04q0zik+vhy7g0EM/LinbQu595i:6veEn3+pCg0EUGQuL5
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" doojuov.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 55b057826c77fb6c5047483f06fbf880.exe -
Executes dropped EXE 1 IoCs
pid Process 3912 doojuov.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /X" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /P" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /V" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /M" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /H" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /K" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /D" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /r" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /i" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /l" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /T" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /f" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /k" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /q" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /L" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /d" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /U" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /t" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /I" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /x" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /A" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /o" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /g" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /J" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /p" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /W" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /a" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /Y" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /O" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /E" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /j" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /S" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /C" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /n" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /F" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /G" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /Z" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /c" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /y" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /N" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /v" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /h" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /w" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /Q" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /R" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /u" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /e" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /m" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /B" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /z" doojuov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doojuov = "C:\\Users\\Admin\\doojuov.exe /s" doojuov.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe 3912 doojuov.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4900 55b057826c77fb6c5047483f06fbf880.exe 3912 doojuov.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 3912 4900 55b057826c77fb6c5047483f06fbf880.exe 94 PID 4900 wrote to memory of 3912 4900 55b057826c77fb6c5047483f06fbf880.exe 94 PID 4900 wrote to memory of 3912 4900 55b057826c77fb6c5047483f06fbf880.exe 94 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88 PID 3912 wrote to memory of 4900 3912 doojuov.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\55b057826c77fb6c5047483f06fbf880.exe"C:\Users\Admin\AppData\Local\Temp\55b057826c77fb6c5047483f06fbf880.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\doojuov.exe"C:\Users\Admin\doojuov.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD5eb9fd318723060e57805e3db4e0cf325
SHA1b7d6eae3ceb30ae3ed2874257b6c2efad09c8545
SHA256b96b7d190112565e8c03f050278986287f34aa01987bd5bcc7d6643fb12a3625
SHA512d260b77abb58c380658bc9d5ca4af90197e978ea71e298a3e76b6cdc7b508ea43eb4ed283cff2076bcdadff103490cf3c3884103ee8f49294930b40bd87682f8