Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-01-2024 16:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77d703ff9dd48c9911fb7b7031552aa9.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
77d703ff9dd48c9911fb7b7031552aa9.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
77d703ff9dd48c9911fb7b7031552aa9.exe
-
Size
156KB
-
MD5
77d703ff9dd48c9911fb7b7031552aa9
-
SHA1
3c0d6ae6b170792eba1f2a6cb8a679ba7195e27b
-
SHA256
44a53d699f900e4e1a2c639856c5389344d0cf35a5d1902ff4187778bffcc08d
-
SHA512
f7c68c9198515a4ace6e3b72cee355d230baf0a79341daa62542abe543480f14a6d07996eadba14f7b52ab3c09d9e8bb5b9782dd871f22fd72a5aa7dd2c463d2
-
SSDEEP
3072:bvo0kMEdu3kSESulCVRgQPwU3MppI1zePMThBgNE5j4oQr:joHu3ESul9LI1zeEhfdu
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 77d703ff9dd48c9911fb7b7031552aa9.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" waaqou.exe -
Executes dropped EXE 1 IoCs
pid Process 2436 waaqou.exe -
Loads dropped DLL 2 IoCs
pid Process 2464 77d703ff9dd48c9911fb7b7031552aa9.exe 2464 77d703ff9dd48c9911fb7b7031552aa9.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /R" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /V" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /w" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /I" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /L" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /x" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /Y" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /p" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /G" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /N" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /E" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /m" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /l" 77d703ff9dd48c9911fb7b7031552aa9.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /e" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /b" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /T" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /H" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /k" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /C" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /o" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /c" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /X" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /S" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /Q" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /t" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /O" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /J" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /M" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /v" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /a" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /z" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /A" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /n" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /P" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /W" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /u" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /i" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /r" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /K" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /y" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /B" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /U" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /q" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /F" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /j" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /h" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /d" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /g" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /f" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /l" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /s" waaqou.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaqou = "C:\\Users\\Admin\\waaqou.exe /Z" waaqou.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2464 77d703ff9dd48c9911fb7b7031552aa9.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe 2436 waaqou.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2464 77d703ff9dd48c9911fb7b7031552aa9.exe 2436 waaqou.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2436 2464 77d703ff9dd48c9911fb7b7031552aa9.exe 28 PID 2464 wrote to memory of 2436 2464 77d703ff9dd48c9911fb7b7031552aa9.exe 28 PID 2464 wrote to memory of 2436 2464 77d703ff9dd48c9911fb7b7031552aa9.exe 28 PID 2464 wrote to memory of 2436 2464 77d703ff9dd48c9911fb7b7031552aa9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\77d703ff9dd48c9911fb7b7031552aa9.exe"C:\Users\Admin\AppData\Local\Temp\77d703ff9dd48c9911fb7b7031552aa9.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\waaqou.exe"C:\Users\Admin\waaqou.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD50cf6a7312cd02ebc5e332a61bc443910
SHA1eb2e00db838ed6d37e4bc6c58a4b6c5afde56305
SHA2566d7da818cc1e3395e72be6fe20cf7f58146490b0f477bf7e990d92434b024a96
SHA512362783cbb0b3e6b3b6b3c9b0947c86c67e236c033797be5f8006c77c85299049173935d6a1a244cee14d633acd2107cb3320046a345f7a6c119b8bc9ccc75dfc