Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 03:27
Static task
static1
Behavioral task
behavioral1
Sample
cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe
Resource
win10v2004-20240508-en
General
-
Target
cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe
-
Size
120KB
-
MD5
89e6e948d69c3bb0ec0e3711cae65952
-
SHA1
ddeaa13e7d941447a9debb4b8e5f040778d92b15
-
SHA256
cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451
-
SHA512
3c8ab0366c59c2b4904b45e857b14232ac0855b2864bccf2cfbc1cbfbab53d5957e8c401fae0b391159ab36ed09e03d8ec431f19530f377f71c5ac0bf71e2d38
-
SSDEEP
3072:xGpbUpd1/l0izZF6yCenK2iGlefx8X1/:xGp+1pzZF44K3AAKX1
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
piateaq.execd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" piateaq.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe -
Executes dropped EXE 1 IoCs
Processes:
piateaq.exepid process 4388 piateaq.exe -
Adds Run key to start application 2 TTPs 51 IoCs
Processes:
piateaq.execd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /A" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /L" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /M" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /o" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /h" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /t" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /O" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /Q" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /K" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /a" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /N" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /P" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /e" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /n" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /N" cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /w" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /y" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /k" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /I" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /G" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /W" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /D" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /c" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /Y" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /C" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /H" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /v" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /q" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /s" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /z" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /m" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /V" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /d" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /b" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /j" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /l" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /g" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /x" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /X" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /f" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /S" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /r" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /R" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /J" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /T" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /B" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /Z" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /i" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /F" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /U" piateaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piateaq = "C:\\Users\\Admin\\piateaq.exe /p" piateaq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exepiateaq.exepid process 4972 cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe 4972 cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe 4388 piateaq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exepiateaq.exepid process 4972 cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe 4388 piateaq.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exedescription pid process target process PID 4972 wrote to memory of 4388 4972 cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe piateaq.exe PID 4972 wrote to memory of 4388 4972 cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe piateaq.exe PID 4972 wrote to memory of 4388 4972 cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe piateaq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe"C:\Users\Admin\AppData\Local\Temp\cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\piateaq.exe"C:\Users\Admin\piateaq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\piateaq.exeFilesize
120KB
MD5f949f729c26efe277e36d2cf782d5523
SHA16a7a56651a5658aed35ceb7522a445a665e9b76f
SHA256c0bf45911e5b0cb724737dc072af89bef9ca03a5d5a9b158117426956ed7d4fe
SHA512749db93cf26ac14ed1674844affdf85ba748f9a1288350859df6f98f7fb7584066d8ef185b04b09e2b3bdd0016e194069d5f018a56173732fd61512908ee8aa9