Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 01:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe
-
Size
88KB
-
MD5
e3ce497d459182b2fb3d538e9375dcd2
-
SHA1
1a9191d696607bc56091b65c92b281e036ff8ef3
-
SHA256
b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422
-
SHA512
349ed90b0494c134ecf191c4debc175baa2bca17a12c3c493f99acd2e4c53fabecba2f535240eab9054d238efc0b6c8c6d4f7488e9656c682f59a8003b74178a
-
SSDEEP
768:vAP68qOJ+TtIjwHpFeh6gM1rA8dOsc7jUq4RkA5o3K1DfsvtzsXjLft+9o1mm:vAPHqlZI0LFjnAzA5o6BfItoXjLl0hm
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" booeroc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe -
Executes dropped EXE 1 IoCs
pid Process 1460 booeroc.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /f" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /t" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /l" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /i" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /s" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /j" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /r" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /w" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /e" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /y" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /c" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /b" b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /d" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /p" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /q" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /h" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /b" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /u" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /o" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /v" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /a" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /m" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /z" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /g" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /n" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /k" booeroc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\booeroc = "C:\\Users\\Admin\\booeroc.exe /x" booeroc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2224 b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe 2224 b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe 1460 booeroc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2224 b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe 1460 booeroc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1460 2224 b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe 102 PID 2224 wrote to memory of 1460 2224 b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe 102 PID 2224 wrote to memory of 1460 2224 b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe"C:\Users\Admin\AppData\Local\Temp\b781086793945cda72dd8840a67ee6bcc1d1cd2a90ac1b7bd489157165e77422.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\booeroc.exe"C:\Users\Admin\booeroc.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5614b84b8d7652f9798b6b82f8f085324
SHA14ef2bfdb4124b2eb1181856d53cb79d2b9d8128a
SHA2561c59710b20dce9cbfe14fef8397b75afa056fb2b6bdd06a8fe476c8d83203165
SHA512719d0013db865898d7b6ed2ab882e3fd34dcbbf2b33f5b3220bb3085363eeded84f7154d507d153ec59ef59ce36239796835b75a42f58484343c170d8383445e