Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:36
Static task
static1
Behavioral task
behavioral1
Sample
c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe
Resource
win10v2004-20240426-en
General
-
Target
c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe
-
Size
196KB
-
MD5
5181b2d1d46f86cf79e100210ca61c79
-
SHA1
45b883ef1ce728f890718601984ed3da450155f1
-
SHA256
c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3
-
SHA512
5f5c4865371c7e0cbc9ab0bf3be24b87fa48e49c78b568744ae547e405c572c2efb98387f649418930f6722c47c23b3885973b9ed0436540d052aabfda22a981
-
SSDEEP
1536:UWtkjQTQfU0GgAJx1kNmKldcBP9VeYDvcC:pkj3fU0GgAX9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exereaege.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" reaege.exe -
Executes dropped EXE 1 IoCs
Processes:
reaege.exepid process 2160 reaege.exe -
Loads dropped DLL 2 IoCs
Processes:
c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exepid process 2420 c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe 2420 c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe -
Adds Run key to start application 2 TTPs 50 IoCs
Processes:
reaege.exec0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /m" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /n" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /q" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /G" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /D" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /M" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /f" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /B" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /w" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /H" c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /Q" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /O" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /o" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /x" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /W" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /F" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /V" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /Y" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /X" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /U" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /L" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /s" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /J" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /c" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /z" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /g" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /p" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /S" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /e" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /K" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /k" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /N" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /E" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /d" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /A" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /Z" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /C" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /y" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /r" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /u" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /P" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /t" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /R" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /T" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /i" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /h" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /H" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /j" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /a" reaege.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reaege = "C:\\Users\\Admin\\reaege.exe /v" reaege.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exereaege.exepid process 2420 c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe 2160 reaege.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exereaege.exepid process 2420 c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe 2160 reaege.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exedescription pid process target process PID 2420 wrote to memory of 2160 2420 c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe reaege.exe PID 2420 wrote to memory of 2160 2420 c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe reaege.exe PID 2420 wrote to memory of 2160 2420 c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe reaege.exe PID 2420 wrote to memory of 2160 2420 c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe reaege.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe"C:\Users\Admin\AppData\Local\Temp\c0af1ce352a449085901369d5a2609aa8ace25e92f3bbc3a6d70c78969c4a0b3.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\reaege.exe"C:\Users\Admin\reaege.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\reaege.exeFilesize
196KB
MD5eede7ce16f5d3724f58702a67ac5cd69
SHA11f76479175fc1bf4640a80d5816b816b4de1bdee
SHA256fe15d399c697953bae98c6ef28c04bdab772ade1e28574ea0fadc1639b785623
SHA512218bfd0ab078d1f0d3db4ae0f11056d209e914df1d326be8c66165a2303f3ac0bcefe74fbfc1f01b56a228262dadf35c99920c3e843df88c0b9086c41c7fe30b
-
memory/2160-15-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2420-0-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2420-9-0x0000000003430000-0x0000000003461000-memory.dmpFilesize
196KB