Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb0dacc62c1711483358886553a9b7a3.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb0dacc62c1711483358886553a9b7a3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
cb0dacc62c1711483358886553a9b7a3.exe
-
Size
204KB
-
MD5
cb0dacc62c1711483358886553a9b7a3
-
SHA1
7db3d44b91346e2e51aa0ac0b01e7b842b5dc021
-
SHA256
83197fd8d834fffb2ca1179a9e0c05cef7a9b838fe986da5e12d9704e5545881
-
SHA512
409e33f78972b8783a5ceb721f2abdf0ef218fa887650842b0e75502b6884cd05cb92d4260bffa92780acd50c0a50b6f9748a64d185066ba81d9146bdbd71a75
-
SSDEEP
6144:Essi/cZrSlO3OW80Nr0SkA6XLeLGvUjouMdDr:EssccVSlW80N4SkA6yKUjouM1r
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cb0dacc62c1711483358886553a9b7a3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" paeocic.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation cb0dacc62c1711483358886553a9b7a3.exe -
Executes dropped EXE 1 IoCs
pid Process 2300 paeocic.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /s" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /t" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /G" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /E" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /A" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /m" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /U" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /h" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /q" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /S" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /P" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /B" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /N" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /W" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /r" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /g" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /O" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /p" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /b" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /z" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /K" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /M" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /T" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /l" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /Y" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /C" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /n" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /c" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /p" cb0dacc62c1711483358886553a9b7a3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /a" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /i" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /f" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /u" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /k" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /e" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /x" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /v" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /I" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /X" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /L" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /y" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /w" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /R" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /V" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /F" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /Q" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /J" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /D" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /Z" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /H" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /o" paeocic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paeocic = "C:\\Users\\Admin\\paeocic.exe /d" paeocic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3404 cb0dacc62c1711483358886553a9b7a3.exe 3404 cb0dacc62c1711483358886553a9b7a3.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe 2300 paeocic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3404 cb0dacc62c1711483358886553a9b7a3.exe 2300 paeocic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3404 wrote to memory of 2300 3404 cb0dacc62c1711483358886553a9b7a3.exe 100 PID 3404 wrote to memory of 2300 3404 cb0dacc62c1711483358886553a9b7a3.exe 100 PID 3404 wrote to memory of 2300 3404 cb0dacc62c1711483358886553a9b7a3.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb0dacc62c1711483358886553a9b7a3.exe"C:\Users\Admin\AppData\Local\Temp\cb0dacc62c1711483358886553a9b7a3.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\paeocic.exe"C:\Users\Admin\paeocic.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD564911775b8ff8e531f21b3ae6dbc9920
SHA128775a37f99544aea534ae163d93817a13fcdec8
SHA2560c7ef29f09a2b8a3e261d6f666264d34cc3d70c6833d87c4a55ec5cd984c0aa6
SHA5129b5084543725c52aae1fdcbff75ffaa0fa5fca729345b828c2ad9da0736e5a8e9aba5716c5fb48929dd51b16720e784bc5246df0c4292b79a65cf78d79a42331