Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-03-2024 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe
-
Size
204KB
-
MD5
6110a0cbdc987136491a76bc64a5f9eb
-
SHA1
a344c9a4074593b13df9f897b26404a75058e4af
-
SHA256
633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d
-
SHA512
827cb748a078821bbf4bd40bab2a1b7377e0c180e59bc72e69ca068c26c07a88ac581eeb6657b6a9e818308b67fbc1d9e9e2f9dedb1aa41c24a569dfd9f014b7
-
SSDEEP
3072:dmDW8E0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWwO:kyD4QxL7B9W0c1RCzR/fSmls
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" toaopil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe -
Executes dropped EXE 1 IoCs
pid Process 1212 toaopil.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /v" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /d" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /l" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /z" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /y" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /w" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /f" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /t" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /c" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /o" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /a" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /r" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /k" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /s" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /d" 633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /u" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /b" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /e" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /g" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /n" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /m" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /j" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /i" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /h" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /q" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /p" toaopil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toaopil = "C:\\Users\\Admin\\toaopil.exe /x" toaopil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4108 633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe 4108 633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe 1212 toaopil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4108 633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe 1212 toaopil.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4108 wrote to memory of 1212 4108 633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe 90 PID 4108 wrote to memory of 1212 4108 633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe 90 PID 4108 wrote to memory of 1212 4108 633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe"C:\Users\Admin\AppData\Local\Temp\633ae82d3d1ef159d16cc8bb5fcf43b78d540a6911927807377874a5d4fa307d.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\toaopil.exe"C:\Users\Admin\toaopil.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD52ca1b51d1e9d42dd54900569d5d2b18b
SHA1a3b05500b0c06bbb7e0712efc4c4e6dff78e8696
SHA25617e8c180ad9f646977d9176f254287a7d4e3101183dab5e7d73b84fb4e70af49
SHA512e80fb2c15025f729cde32f02c7c379275d6a85156e719715017e461807f3a77c363b8c87f89b988acaf173a55d7174fb60664293b10271b643d7f412bb88307d