Analysis
-
max time kernel
152s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66614b494e996fd93a206f90c226b44c.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
66614b494e996fd93a206f90c226b44c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
66614b494e996fd93a206f90c226b44c.exe
-
Size
108KB
-
MD5
66614b494e996fd93a206f90c226b44c
-
SHA1
ba57502b0b4a967b563b30f768727c7da92e5b79
-
SHA256
3a1cc2231067d08e587bf60634918b60bd9ccedfd961bf5fec191c517c3bd5bd
-
SHA512
ba173cf49aae1fd538f3b34417188043c55377740bd59975e62384860949e6fee22ec12b3a8133cafd88271f65b8b8d2fecff3bdf93a9c5225c1299d058435aa
-
SSDEEP
1536:MUX/V5Ejes5mBVKuCrENMRs7IkXjVLwhJt5G35Xm4ofWmkVpgWKBjWSKM8IVbnO0:fX/QQCs7IkXhWyGCnVE
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 66614b494e996fd93a206f90c226b44c.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hiuene.exe -
Executes dropped EXE 1 IoCs
pid Process 2240 hiuene.exe -
Loads dropped DLL 2 IoCs
pid Process 1360 66614b494e996fd93a206f90c226b44c.exe 1360 66614b494e996fd93a206f90c226b44c.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /N" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /x" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /K" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /X" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /j" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /r" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /b" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /I" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /g" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /E" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /F" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /l" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /R" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /z" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /y" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /e" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /v" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /Z" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /o" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /s" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /L" 66614b494e996fd93a206f90c226b44c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /a" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /Y" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /A" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /k" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /H" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /f" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /J" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /M" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /q" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /Q" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /m" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /D" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /T" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /P" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /O" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /C" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /i" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /S" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /p" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /h" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /u" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /d" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /L" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /n" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /t" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /G" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /U" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /W" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /V" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /c" hiuene.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuene = "C:\\Users\\Admin\\hiuene.exe /w" hiuene.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1360 66614b494e996fd93a206f90c226b44c.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe 2240 hiuene.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1360 66614b494e996fd93a206f90c226b44c.exe 2240 hiuene.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1360 wrote to memory of 2240 1360 66614b494e996fd93a206f90c226b44c.exe 28 PID 1360 wrote to memory of 2240 1360 66614b494e996fd93a206f90c226b44c.exe 28 PID 1360 wrote to memory of 2240 1360 66614b494e996fd93a206f90c226b44c.exe 28 PID 1360 wrote to memory of 2240 1360 66614b494e996fd93a206f90c226b44c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\66614b494e996fd93a206f90c226b44c.exe"C:\Users\Admin\AppData\Local\Temp\66614b494e996fd93a206f90c226b44c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\hiuene.exe"C:\Users\Admin\hiuene.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD56c8442984b0cce0c93ebcac0af2fdcce
SHA148cdf23319f2d06357621ceca16aa6a7b6cd79a3
SHA2564af0bd8ce0f222a03976b4bb86e2b903446c7283299ee864d0ae5b35fd30c720
SHA51250ca37cf9784f75af78bc4160ac24d7d36ab118792aebf208ffae8fdda2442c4a87d38ca2d083cd407682872039c819d457254e902460bbd79202065b88906e9