Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2024 03:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b4c0efd868f312725b7e6f48177517b.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b4c0efd868f312725b7e6f48177517b.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
8b4c0efd868f312725b7e6f48177517b.exe
-
Size
96KB
-
MD5
8b4c0efd868f312725b7e6f48177517b
-
SHA1
c300b818e7a568d1b3652d081c3d6d75674d54c5
-
SHA256
9e360c9739c4311e83721575be9bd4b37a5a786f137da98c6aeeb9a617c45228
-
SHA512
25bea33c1170fd6e8d67470cd2b870ff333afcd16e6bbda62674d7ed6ed8e40ea2ed873611a11b00557bb245df3392447623b1e497155ba464f8378ed2319fe5
-
SSDEEP
1536:ejEg52p9tyVQO8P8ychbEfwjj3RJNEo/knRzdnynE7RldNEP8lijOe00n+GNIjng:UE/pelychQSzR3Ek65Rldq00n+GCng
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8b4c0efd868f312725b7e6f48177517b.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" diefauk.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 8b4c0efd868f312725b7e6f48177517b.exe -
Executes dropped EXE 1 IoCs
pid Process 5084 diefauk.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /d" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /m" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /F" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /q" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /D" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /B" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /e" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /H" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /P" 8b4c0efd868f312725b7e6f48177517b.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /w" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /S" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /p" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /j" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /Y" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /x" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /g" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /v" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /l" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /a" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /u" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /J" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /i" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /k" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /N" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /E" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /Z" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /O" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /n" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /M" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /A" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /h" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /t" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /W" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /T" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /c" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /r" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /o" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /b" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /I" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /V" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /K" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /z" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /U" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /C" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /X" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /y" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /s" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /P" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /G" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /Q" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /R" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /L" diefauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diefauk = "C:\\Users\\Admin\\diefauk.exe /f" diefauk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1356 8b4c0efd868f312725b7e6f48177517b.exe 1356 8b4c0efd868f312725b7e6f48177517b.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe 5084 diefauk.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1356 8b4c0efd868f312725b7e6f48177517b.exe 5084 diefauk.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1356 wrote to memory of 5084 1356 8b4c0efd868f312725b7e6f48177517b.exe 91 PID 1356 wrote to memory of 5084 1356 8b4c0efd868f312725b7e6f48177517b.exe 91 PID 1356 wrote to memory of 5084 1356 8b4c0efd868f312725b7e6f48177517b.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b4c0efd868f312725b7e6f48177517b.exe"C:\Users\Admin\AppData\Local\Temp\8b4c0efd868f312725b7e6f48177517b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\diefauk.exe"C:\Users\Admin\diefauk.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5211e01d54e2dba791c41bb810ca95b4a
SHA117692ed75d1a111453215a6d382ba5bf5e691ff9
SHA2562c35ac6d5781ca4543d8e0195e48d1e005f4d7556ab8b080a774640c0281615a
SHA5120ec1d8508226eb31db398aeb953e49804d41a695c92d50c40c7f283420741abc7e24d2e58d98e4e6b092e5bd3dd74cc4b89ad15bb5af944d1d598384f2d13433