Analysis
-
max time kernel
165s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d06306b6a04fba8a02edbf3410624a2.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7d06306b6a04fba8a02edbf3410624a2.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
7d06306b6a04fba8a02edbf3410624a2.exe
-
Size
280KB
-
MD5
7d06306b6a04fba8a02edbf3410624a2
-
SHA1
98513cadbf73c45ea0e4f0fe2faa64fc2a6a0205
-
SHA256
a2708084a07e5f2a81b0b2b8b224da86f8655d33cf31bb6d87c73453755cea67
-
SHA512
338805d015ac03bbc3f07cf1a3bb1c3bd56c9b0c6d2914db98a1d13d5a24a3a93df8097d62f8e34a58c10decd717132cee94ccccc4aaea7cf127e5d0cac06476
-
SSDEEP
3072:Da3TiHOPiu8aQb3TqDUCiGjHJDbRv9y+qwa+rZf/MVBXAF:mTiHOq3TqD+0HBb5ta+rZ3MTW
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nuoor.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7d06306b6a04fba8a02edbf3410624a2.exe -
Executes dropped EXE 1 IoCs
pid Process 2332 nuoor.exe -
Loads dropped DLL 2 IoCs
pid Process 2896 7d06306b6a04fba8a02edbf3410624a2.exe 2896 7d06306b6a04fba8a02edbf3410624a2.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /m" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /x" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /a" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /J" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /K" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /h" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /T" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /p" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /I" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /b" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /P" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /D" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /o" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /X" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /G" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /l" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /E" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /i" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /q" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /Z" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /c" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /U" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /y" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /u" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /r" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /F" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /A" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /v" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /d" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /k" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /H" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /s" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /O" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /V" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /z" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /Q" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /j" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /n" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /d" 7d06306b6a04fba8a02edbf3410624a2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /w" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /S" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /f" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /Y" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /R" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /M" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /W" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /g" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /B" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /L" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /C" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /t" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /e" nuoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuoor = "C:\\Users\\Admin\\nuoor.exe /N" nuoor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2896 7d06306b6a04fba8a02edbf3410624a2.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe 2332 nuoor.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2896 7d06306b6a04fba8a02edbf3410624a2.exe 2332 nuoor.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2332 2896 7d06306b6a04fba8a02edbf3410624a2.exe 27 PID 2896 wrote to memory of 2332 2896 7d06306b6a04fba8a02edbf3410624a2.exe 27 PID 2896 wrote to memory of 2332 2896 7d06306b6a04fba8a02edbf3410624a2.exe 27 PID 2896 wrote to memory of 2332 2896 7d06306b6a04fba8a02edbf3410624a2.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d06306b6a04fba8a02edbf3410624a2.exe"C:\Users\Admin\AppData\Local\Temp\7d06306b6a04fba8a02edbf3410624a2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\nuoor.exe"C:\Users\Admin\nuoor.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD57e9ab4ad817a8170466058211b6af5b5
SHA1aebb3ffd66f366c3c8896f9c907155c97ea85575
SHA25653e4e575d0835bc52013544b79516d0a5fd8a7636096cd2fff0f03ae5370c777
SHA512ed083871585a79c4a63f543764725f8b616a8e2f48e699e2cd44e8ee2a81fe9956e2f225c7084e01287a264bb0c8258ae4c021dd987c1dc77d864a43e1d0fea6