Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/02/2024, 08:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8671b038ea4c525382f4518d6b57c7c3.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8671b038ea4c525382f4518d6b57c7c3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
8671b038ea4c525382f4518d6b57c7c3.exe
-
Size
164KB
-
MD5
8671b038ea4c525382f4518d6b57c7c3
-
SHA1
6dda926f938f3fc8e44468c05469547b9a5e5588
-
SHA256
34de36da87a46160cfcdddf07817cfb02bb63578ac78b1b7f2b3987aafff5ef3
-
SHA512
04ebe0053c5886a2d13f6d2a4f01fd09f38c8e74149b15db38e46be8e579dac8c526fd085abed37f7a8ae9c2f30caff09eef94857a3cd3649832193be9e18466
-
SSDEEP
1536:qMSwdqgJ7zGYLwKABCIvhZ9C9eO4F+NPouHj6Koa6Epm0SS+F8OJ6t+:hSwdqmGYL/t6jaUS+
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8671b038ea4c525382f4518d6b57c7c3.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qoaojod.exe -
Executes dropped EXE 1 IoCs
pid Process 2180 qoaojod.exe -
Loads dropped DLL 2 IoCs
pid Process 1732 8671b038ea4c525382f4518d6b57c7c3.exe 1732 8671b038ea4c525382f4518d6b57c7c3.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /v" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /l" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /t" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /p" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /f" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /w" 8671b038ea4c525382f4518d6b57c7c3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /q" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /j" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /v" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /z" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /p" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /y" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /n" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /b" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /j" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /x" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /u" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /y" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /i" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /b" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /k" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /z" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /e" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /g" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /c" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /s" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /c" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /r" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /h" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /s" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /a" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /t" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /n" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /m" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /k" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /d" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /m" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /i" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /a" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /l" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /g" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /h" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /w" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /q" 8671b038ea4c525382f4518d6b57c7c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /o" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /u" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /q" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /f" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /d" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /r" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /x" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /w" qoaojod.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /o" qoaojod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qoaojod = "C:\\Users\\Admin\\qoaojod.exe /e" qoaojod.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1732 8671b038ea4c525382f4518d6b57c7c3.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe 2180 qoaojod.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1732 8671b038ea4c525382f4518d6b57c7c3.exe 2180 qoaojod.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2180 1732 8671b038ea4c525382f4518d6b57c7c3.exe 28 PID 1732 wrote to memory of 2180 1732 8671b038ea4c525382f4518d6b57c7c3.exe 28 PID 1732 wrote to memory of 2180 1732 8671b038ea4c525382f4518d6b57c7c3.exe 28 PID 1732 wrote to memory of 2180 1732 8671b038ea4c525382f4518d6b57c7c3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8671b038ea4c525382f4518d6b57c7c3.exe"C:\Users\Admin\AppData\Local\Temp\8671b038ea4c525382f4518d6b57c7c3.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\qoaojod.exe"C:\Users\Admin\qoaojod.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD571e80be2feaaa208eb5089fe011b6d1c
SHA1abca5c57cffbe83ac99e74ed8329246a6cf11b4e
SHA256922a9010d4d86db1603160ac7a0988a6bdf9a5d1d9ff69ef272c91a927508513
SHA51274d8ade97945fbd7dfa444485247f1b9f54c6d5a9de9e35dbd3c4df6f4e079a91a1d5f582883777a9a96ac7a4f648dfd7e39f741e54ed6a9c8eeaea3c051394e