Analysis
-
max time kernel
160s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 02:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe
-
Size
136KB
-
MD5
3d9f35c8e8c59244973233a4504b60ec
-
SHA1
28f3ee979034d90c0ea0e6ea9fd42c2ea7cec482
-
SHA256
9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316
-
SHA512
ef8c4230ae11e62e9feb0a8efce407f2d0553013391975a3cbf396fb5e100bb7cb435d34b0b8e24ed9f179a929d95512c8401e35269ddb3ea4b9bbb6dbd25894
-
SSDEEP
3072:Myrz0RRG/J9t538E6tZqAwZh5dKzio3CfNynXp5ucK1FaeHX0WRyn:jU9kAwWiHEWRG
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" roiay.exe -
Executes dropped EXE 1 IoCs
pid Process 2968 roiay.exe -
Loads dropped DLL 2 IoCs
pid Process 2988 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe 2988 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /j" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /v" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /w" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /u" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /a" 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /b" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /g" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /n" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /y" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /x" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /o" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /e" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /r" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /d" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /p" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /l" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /k" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /f" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /m" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /c" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /t" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /i" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /z" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /s" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /q" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /h" roiay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\roiay = "C:\\Users\\Admin\\roiay.exe /a" roiay.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2988 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe 2968 roiay.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2988 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe 2968 roiay.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2968 2988 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe 27 PID 2988 wrote to memory of 2968 2988 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe 27 PID 2988 wrote to memory of 2968 2988 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe 27 PID 2988 wrote to memory of 2968 2988 9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe"C:\Users\Admin\AppData\Local\Temp\9e46492f3ee4bcdaedbb20776ef9ae8fe8a149d94bad38563e014c45a3416316.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\roiay.exe"C:\Users\Admin\roiay.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5620f65366ac7b8bead335ed01efd4968
SHA12afe528b24a248d751def6476e451a890906c581
SHA2569d9a83a98512ff07a350569863d2a6e8ed01a2045736b7421f83e63089e40d67
SHA512471c1da57be1c90e676e3958cd59db1c0e49f15192eeeab118534e4edcff166f94181086a23f45a148036a23c71a8298a7f03368cf7e920cd5377105505b7b8a