Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/04/2024, 21:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe
-
Size
248KB
-
MD5
6498c5fe09bdf468d1113e29d0f347e3
-
SHA1
63879771161e100ae063ca03eb167fcbade21958
-
SHA256
52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11
-
SHA512
a2eb9e2b319b068678028bec13185a0c1ca625e20303a91dcff84189627c2553077249f415a6d85ffc30ac8af2ea0e6049da3c7c0111fa4fddc67028a8ac602f
-
SSDEEP
3072:Nm38bUQSxsjJhU8hPsOkLJeJ7JwJHJ6JkBTriGXfXkGN3tqZ4xoRg4Sx+Tidczf/:CUUBkhh8op2pYOF0yIdgFGh
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" feizui.exe -
Executes dropped EXE 1 IoCs
pid Process 2872 feizui.exe -
Loads dropped DLL 2 IoCs
pid Process 1736 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe 1736 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /h" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /e" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /n" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /m" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /j" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /c" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /f" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /z" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /r" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /i" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /k" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /o" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /g" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /x" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /d" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /m" 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /a" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /u" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /w" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /q" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /b" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /l" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /p" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /t" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /y" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /s" feizui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\feizui = "C:\\Users\\Admin\\feizui.exe /v" feizui.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1736 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe 2872 feizui.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1736 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe 2872 feizui.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2872 1736 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe 28 PID 1736 wrote to memory of 2872 1736 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe 28 PID 1736 wrote to memory of 2872 1736 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe 28 PID 1736 wrote to memory of 2872 1736 52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe"C:\Users\Admin\AppData\Local\Temp\52214339a9d3fcb0345b7415ff34a8d0256fa8a02f2fa85793dd89503d296b11.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\feizui.exe"C:\Users\Admin\feizui.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD54671beec134882d562c5779f438ff45f
SHA10e1b731e2382a76b684e40ae39a786cce2d28e8f
SHA256ee14f4542278bca2268c1b66c145c72abe42b16249596a02a4114b4da059076e
SHA51251e111c055e9d5b1629a570e528935f9396fde874e4b96099b5393ce503cc0a6daae4a56eda82335b062a3e56b484654ca6c6b42d950c6c9bef37bca2b56f5ad