Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 23:44
Static task
static1
Behavioral task
behavioral1
Sample
cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
Resource
win10v2004-20240226-en
General
-
Target
cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
-
Size
216KB
-
MD5
000e3b49539c7a05bd04ce3626f8cd19
-
SHA1
f2455b37eb2bc1dd2d89e8efd16874803cbf2903
-
SHA256
cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048
-
SHA512
b0693268653881b9bfe105445b40a9e2d1f7cb20b4b1e391d16a9c856101b4432c7064685cf75592d8678c3f9bb101a9624f6b802c3398b7e3faa2f3ee2374bc
-
SSDEEP
6144:H2fIfrt3+TetonBi3QxRy4g09ICSnqf9uSUgkxtpsaPjK/bEoK828fwAoEn+MM:H2Irt3+TetonBi3QxRwfnqf9uSUgkxtZ
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" houweut.exe -
Executes dropped EXE 1 IoCs
pid Process 2536 houweut.exe -
Loads dropped DLL 2 IoCs
pid Process 1640 cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe 1640 cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /M" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /y" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /C" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /Q" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /l" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /h" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /m" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /L" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /U" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /V" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /B" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /E" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /t" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /K" cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /H" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /g" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /W" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /z" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /R" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /q" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /v" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /Y" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /w" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /I" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /G" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /N" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /b" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /J" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /u" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /j" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /x" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /d" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /o" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /r" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /f" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /X" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /T" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /O" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /D" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /A" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /c" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /P" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /n" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /a" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /Z" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /F" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /k" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /i" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /p" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /s" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /K" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /S" houweut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\houweut = "C:\\Users\\Admin\\houweut.exe /e" houweut.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1640 cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe 2536 houweut.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1640 cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe 2536 houweut.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2536 1640 cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe 28 PID 1640 wrote to memory of 2536 1640 cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe 28 PID 1640 wrote to memory of 2536 1640 cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe 28 PID 1640 wrote to memory of 2536 1640 cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe"C:\Users\Admin\AppData\Local\Temp\cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\houweut.exe"C:\Users\Admin\houweut.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD572761e610e9fd9ef0272bd3a32b02611
SHA1df7dc8f9ec92716d24f607daa3de52436c55b0bf
SHA256e32dd7963e866abfce4ab126b8a56cd09107f6de8025fc099dd654956b8fb4af
SHA5125e5db105729adc161702a61268a4331e9de839bcd94da7219064091b7136ae953c0d91fad53ceeb46594fc3187c354a36f503cb2d725b85bdc9dc9db112bc2a7