Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 03:39
Static task
static1
Behavioral task
behavioral1
Sample
d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe
Resource
win10v2004-20240226-en
General
-
Target
d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe
-
Size
53KB
-
MD5
d7e30d3b60915d90fabd9e1d45da1838
-
SHA1
e9c4d15232439d2d8ec83f47390506a62b692a2b
-
SHA256
d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1
-
SHA512
d3b6acd5c47abe37f2b62c4ba6f59bd60569b386881ac257ef758c42a756be87c4485f1395691e750d5eac6a5ca19ca7ba91dc65e9cdeb19557597820037da91
-
SSDEEP
1536:vN7g8r8Q8A2L1Y7Kp3StjEMjmLM3ztDJWZsXy4JzxPM0:r2L2JJjmLM3zRJWZsXy4J9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
tuozo.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tuozo.exe -
Executes dropped EXE 1 IoCs
Processes:
tuozo.exepid process 2980 tuozo.exe -
Loads dropped DLL 2 IoCs
Processes:
d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exepid process 2372 d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe 2372 d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tuozo.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\tuozo = "C:\\Users\\Admin\\tuozo.exe" tuozo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tuozo.exepid process 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe 2980 tuozo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exetuozo.exepid process 2372 d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe 2980 tuozo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exetuozo.exedescription pid process target process PID 2372 wrote to memory of 2980 2372 d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe tuozo.exe PID 2372 wrote to memory of 2980 2372 d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe tuozo.exe PID 2372 wrote to memory of 2980 2372 d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe tuozo.exe PID 2372 wrote to memory of 2980 2372 d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe tuozo.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe PID 2980 wrote to memory of 2372 2980 tuozo.exe d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe"C:\Users\Admin\AppData\Local\Temp\d17f361a08053d856acab983ff369f2439511597ae403209dc07e604fba358a1.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\tuozo.exe"C:\Users\Admin\tuozo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\tuozo.exeFilesize
53KB
MD5eec1fd8afb2af619589a44163299a094
SHA150bb18272cf26e2552ab996c3d9c1ad97b7af598
SHA25649906450a8b5c9a924d28d8695a180ae1e25a3e0eb6915c980635647c0b455c9
SHA512c233e8ae39b7e9a31c497f247f5943051d6afc657ea1f0d2abccb0ff2e180a979b7b4d3873878a28b0577d856967d29ef5e686d5908fe85b250e671bd531a4dc
-
memory/2372-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2372-10-0x0000000002790000-0x00000000027A2000-memory.dmpFilesize
72KB
-
memory/2372-14-0x0000000002790000-0x00000000027A2000-memory.dmpFilesize
72KB
-
memory/2980-16-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB