Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 05:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe
-
Size
180KB
-
MD5
cc8ee768ddc01e354c72af59c403bf34
-
SHA1
995beef4affc4d57431c33ac96b2ae186e67b1da
-
SHA256
3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883
-
SHA512
a83d5ce15843a6bc31bff9c99605125ce8be18d359cdf367b3c81bcefb417ef69e8b49f8e759e3d773d1a7de273837acdcda7487b2436904676c7895cf3bf3d1
-
SSDEEP
768:lo/HdO9VWJvXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:lVoWHyj6S3T77
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" viuoqu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe -
Executes dropped EXE 1 IoCs
pid Process 4972 viuoqu.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\viuoqu = "C:\\Users\\Admin\\viuoqu.exe" viuoqu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe 4972 viuoqu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3300 3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe 4972 viuoqu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3300 wrote to memory of 4972 3300 3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe 85 PID 3300 wrote to memory of 4972 3300 3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe 85 PID 3300 wrote to memory of 4972 3300 3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe 85 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84 PID 4972 wrote to memory of 3300 4972 viuoqu.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe"C:\Users\Admin\AppData\Local\Temp\3fe6797c92800c21d60ebecb385eec82b782b9b3f71b8241e62754348349c883.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\viuoqu.exe"C:\Users\Admin\viuoqu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5b92d20f36cb4b7d6c0408a820e581359
SHA17c54cd428354f560120f7def939a6d20cf8e3416
SHA25643f787c5a6d983cbb87e1516028da4f4505e55611559a5a5eedb45f158f99fca
SHA512d403b1018b6a89d640652f4b308ecb38e8d766e030a4b7487d034ca24288c4cc2bc90ac7611203bddbe41560f765a1d1b2f956005041a2c633b48e47fa7f85a1