Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe
-
Size
204KB
-
MD5
59fa6771da7417db131da80f95bf188a
-
SHA1
8258b4f8c0acd1aeb80dabe0213f0ec8735d983b
-
SHA256
671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b
-
SHA512
d04d17f3d1510972966556812376055ec3ff1934b4c7558f12a8d4bddb27c869ea6022355c0e5b09a9ce400253ca6b9b51f9467d69535203a82878a76322c3e9
-
SSDEEP
3072:kamCW8jJ0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWV5C:03O4QxL7B9W0c1RCzR/fSmluY
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nuuos.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe -
Executes dropped EXE 1 IoCs
pid Process 232 nuuos.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /t" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /x" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /u" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /g" 671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /y" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /b" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /l" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /p" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /e" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /a" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /w" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /s" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /h" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /c" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /o" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /f" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /r" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /q" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /j" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /g" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /d" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /v" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /m" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /n" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /i" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /z" nuuos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuuos = "C:\\Users\\Admin\\nuuos.exe /k" nuuos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3016 671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe 3016 671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe 232 nuuos.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3016 671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe 232 nuuos.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3016 wrote to memory of 232 3016 671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe 92 PID 3016 wrote to memory of 232 3016 671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe 92 PID 3016 wrote to memory of 232 3016 671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe"C:\Users\Admin\AppData\Local\Temp\671b91575543719261a652dd7b88f48468b8a81c29aad99e08cd3b3f0371710b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\nuuos.exe"C:\Users\Admin\nuuos.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵PID:4344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD527dfdb7e3c471c84256d45a69aa59386
SHA1f8a54107c761adf3bafd9a3cccb366f6ebbf5c67
SHA25603c85f7da4a96504d0e01115a1b340992a5704ea4d2039ff1c0a9edc2d5ff4dc
SHA512301da3e6bcd241c741f2fb74b5fbd076d97ff21dab11c722599408276be57c4859db9f2b9591331e6335efac2a66fe5d5078f44446c32f10a267368dd2f78cee