Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 00:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
666848a9e165d7c903d0487dc1f750eb.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
666848a9e165d7c903d0487dc1f750eb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
666848a9e165d7c903d0487dc1f750eb.exe
-
Size
88KB
-
MD5
666848a9e165d7c903d0487dc1f750eb
-
SHA1
4695e137963e7209a2a83244d4b685c8fc4cf6ee
-
SHA256
b5bed248ad3deb4dbf8ceb44c42c2db0d863cf4baa768c73955c554a471ed5bd
-
SHA512
d609e8a4dbe55bcb95c6ed8c5be4b781ee8d520d863acf886efb0cf2a28e3994c77324d92345c51d810a2d7386d241b803f70b6d79d5d275c8565c2c1cbf88e1
-
SSDEEP
1536:jOPnojSpy8tXG06YpqdXTsYJ/F+FBFIFGFYF7DUZxTZHaa:MuSs0G0mZ2r
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" riiejer.exe -
Executes dropped EXE 1 IoCs
pid Process 2284 riiejer.exe -
Loads dropped DLL 2 IoCs
pid Process 2332 666848a9e165d7c903d0487dc1f750eb.exe 2332 666848a9e165d7c903d0487dc1f750eb.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /H" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /e" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /i" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /V" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /a" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /U" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /I" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /n" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /s" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /E" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /d" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /O" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /g" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /q" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /J" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /D" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /c" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /M" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /K" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /z" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /N" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /Q" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /l" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /F" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /W" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /S" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /T" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /m" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /b" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /w" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /v" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /x" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /B" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /p" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /t" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /k" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /P" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /G" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /j" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /R" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /C" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /Z" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /A" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /X" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /h" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /u" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /f" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /y" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /o" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /Y" riiejer.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\riiejer = "C:\\Users\\Admin\\riiejer.exe /L" riiejer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe 2284 riiejer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2332 666848a9e165d7c903d0487dc1f750eb.exe 2284 riiejer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2284 2332 666848a9e165d7c903d0487dc1f750eb.exe 28 PID 2332 wrote to memory of 2284 2332 666848a9e165d7c903d0487dc1f750eb.exe 28 PID 2332 wrote to memory of 2284 2332 666848a9e165d7c903d0487dc1f750eb.exe 28 PID 2332 wrote to memory of 2284 2332 666848a9e165d7c903d0487dc1f750eb.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\666848a9e165d7c903d0487dc1f750eb.exe"C:\Users\Admin\AppData\Local\Temp\666848a9e165d7c903d0487dc1f750eb.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\riiejer.exe"C:\Users\Admin\riiejer.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5df804c4637b238904ee546f8a7840370
SHA1003d69189541e21088cae399d5e56c15f8c759a0
SHA256018848ec76b8c9117440ac490ca72f5132025d158d56c5362282aad52333d3d6
SHA5128919c8e9c288ac42597880fb986e75372883dae669d1ea4c45b77ee004d312f90695291e8d6efd0efdce4221dd6fad7688396efd3a7a0c4cc3c43609557cd597