Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe
-
Size
132KB
-
MD5
8271483b435b192075acc08251b0eb3c
-
SHA1
5c1d4300120c570eb4b280b1ee4432d2d090d840
-
SHA256
08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05
-
SHA512
a3a52af01380f196e3d73436aae1d8ebf25800f1b91ed06c5d53fa98921d0d2a6fbb31c34d41255f97ad48fbbcf4ba8d5f93010176fc352360f51730c4976bed
-
SSDEEP
3072:+L3cU0qEBNBGh3Gi85CJIldRonVI0mgn0W4zubD:+wU0qEBzGhWiiCDVI0mgnzk
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" miikuo.exe -
Executes dropped EXE 1 IoCs
pid Process 1384 miikuo.exe -
Loads dropped DLL 2 IoCs
pid Process 2824 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe 2824 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /E" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /R" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /o" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /F" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /n" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /V" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /w" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /c" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /e" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /g" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /T" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /A" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /Y" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /K" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /y" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /Q" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /q" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /f" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /M" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /S" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /O" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /z" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /j" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /P" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /Z" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /s" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /b" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /C" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /p" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /J" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /k" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /B" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /H" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /U" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /K" 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /N" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /I" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /v" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /X" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /d" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /t" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /m" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /r" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /l" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /G" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /L" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /i" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /a" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /D" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /h" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /x" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /W" miikuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\miikuo = "C:\\Users\\Admin\\miikuo.exe /u" miikuo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe 1384 miikuo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2824 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe 1384 miikuo.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2824 wrote to memory of 1384 2824 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe 28 PID 2824 wrote to memory of 1384 2824 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe 28 PID 2824 wrote to memory of 1384 2824 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe 28 PID 2824 wrote to memory of 1384 2824 08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe"C:\Users\Admin\AppData\Local\Temp\08d1cf3f790eec1acac50661d0f5c0cab4b60d6c8195385416ffc7f9c0d77f05.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\miikuo.exe"C:\Users\Admin\miikuo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5119275ea66a2364caa2a7d7d855377c8
SHA167875b564a7f1e6e68dfc08228e3eba51c98b63e
SHA2565a15f06f9540f4c1f509c753e585d26a5667a98c54df03454daa7b4597ac2f45
SHA512bcc16480cb04e7aa3ffaebefe5bc18a7dfee9e7b4c879bd6bfb917082abea8bc50928c5ffcefed77020689603a606159d3f78b1fff1802bfa3bf3a5ad6312d84