Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe
-
Size
88KB
-
MD5
94a5c7f44778ce2fef26dca4f29af2d8
-
SHA1
46f04d966b60301098290f6cb2b29532ccdd4c84
-
SHA256
d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300
-
SHA512
8701957fe5418cc8ed4cf6668271529e200d0ca98dd95dc73cb388e5f8b694f2f1e04de7c437e06431c5ff2ef1c7cec4cf27d3584f006aae34c510dce446a71a
-
SSDEEP
768:vAh68qOJ+TtE9RwHpFeh6gM1rA8dOsc7jUq4RkA5o3K1DfsvtzsXjLft+9o1mm:vAhHqlZEoLFjnAzA5o6BfItoXjLl0hm
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nibey.exe -
Executes dropped EXE 1 IoCs
pid Process 2516 nibey.exe -
Loads dropped DLL 2 IoCs
pid Process 2016 d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe 2016 d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /p" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /f" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /b" d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /d" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /m" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /j" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /k" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /o" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /l" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /g" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /y" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /x" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /b" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /i" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /h" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /v" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /c" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /t" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /r" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /z" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /a" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /n" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /e" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /q" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /u" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /s" nibey.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\nibey = "C:\\Users\\Admin\\nibey.exe /w" nibey.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2016 d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe 2516 nibey.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2016 d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe 2516 nibey.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2516 2016 d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe 28 PID 2016 wrote to memory of 2516 2016 d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe 28 PID 2016 wrote to memory of 2516 2016 d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe 28 PID 2016 wrote to memory of 2516 2016 d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe"C:\Users\Admin\AppData\Local\Temp\d857497b50a6241eeeb60a0d12fd89f1d2712ed7c83979b4ea0b40dd350f5300.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\nibey.exe"C:\Users\Admin\nibey.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5256ea8001de4fc763b3feafafb97d046
SHA1ef2deefe0e72c090c3955a32d4abcef592adc5d2
SHA2564cca8f4782a1a15c53abcf03256fe53eaf4eb883975d33b3c056e53f8fe6d8d6
SHA512eaa14777a3be6ab9c3ff0989bb7260adcb179e268603e9d2717bc50b59f5f77d2872d0804eb9dc8838432303e90dd803a403d8f4594e50a7e7608d3b0d2604e0