Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 16:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbc03fc6d7b83a28a37eb1a2419058f2.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
bbc03fc6d7b83a28a37eb1a2419058f2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
bbc03fc6d7b83a28a37eb1a2419058f2.exe
-
Size
84KB
-
MD5
bbc03fc6d7b83a28a37eb1a2419058f2
-
SHA1
1946daa87b71440af4f238fb4a9dd00b6250b7f0
-
SHA256
53b4b813df5467e387a7c2813c0585d2f95e2ca4ec6758be78591f8663319082
-
SHA512
09b47f51c3c2c82c8978600dc542cbc6d158b6a87c3256c0955bdaa43ec15ca19906d6efc4f96b77f5e647b64f86e4ffd4681019c35f9e070be58ff254daed3e
-
SSDEEP
1536:v78yfa7bg4htUVGLG/wXJYeUj27dTGHq13i6E:jEUVeG/wXJY527Y
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bbc03fc6d7b83a28a37eb1a2419058f2.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" beoevu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation bbc03fc6d7b83a28a37eb1a2419058f2.exe -
Executes dropped EXE 1 IoCs
pid Process 1972 beoevu.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /u" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /x" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /g" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /j" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /n" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /y" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /c" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /d" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /a" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /q" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /e" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /m" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /s" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /h" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /p" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /w" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /i" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /r" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /b" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /l" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /v" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /k" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /f" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /t" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /o" beoevu.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /t" bbc03fc6d7b83a28a37eb1a2419058f2.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoevu = "C:\\Users\\Admin\\beoevu.exe /z" beoevu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 800 bbc03fc6d7b83a28a37eb1a2419058f2.exe 800 bbc03fc6d7b83a28a37eb1a2419058f2.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe 1972 beoevu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 800 bbc03fc6d7b83a28a37eb1a2419058f2.exe 1972 beoevu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 800 wrote to memory of 1972 800 bbc03fc6d7b83a28a37eb1a2419058f2.exe 97 PID 800 wrote to memory of 1972 800 bbc03fc6d7b83a28a37eb1a2419058f2.exe 97 PID 800 wrote to memory of 1972 800 bbc03fc6d7b83a28a37eb1a2419058f2.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbc03fc6d7b83a28a37eb1a2419058f2.exe"C:\Users\Admin\AppData\Local\Temp\bbc03fc6d7b83a28a37eb1a2419058f2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\beoevu.exe"C:\Users\Admin\beoevu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD53d47aea273ae315c6977b6bea3364ee3
SHA11ae89934592dedac5cf05e96ae05a99aedf48d23
SHA2568dbfb5d7b79c1fbbc195577eaceafc25a5eb38ad0a896273937142d55a98efd6
SHA512f63a609407752448bb844b821e1a0bbc28d3857bed2ad4ce106aaf6be0a66914cbb37431777bd3c306a2b991bac38eb8e5dbee61e756121722e8e556bb165490