ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991

General

Target

ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe
Size

96KB
MD5

36412e480cfee73b256af719faccfa93
SHA1

c6c44ae4599b6ff8522223c8225235ac0fd3c574
SHA256

ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991
SHA512

b4f738e65940a10a233acfaf11a90c9efd8f3c771ec0b01861246dda7d85d611800e543a7b7fb3f236c1020ef959cdd136069cd7590fb4b9fa42e32b6a18bce0
SSDEEP

1536:QSBH+gzWwmhLmncdkadGVScGYJXeiyCnO+TI4K4I4i404R4Z1VcvsJOpPpMm4/Ny:DHfW6cOadGRJuH7ut/Tdvd+hXV/vU3vV

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

joeevi.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	joeevi.exe

Executes dropped EXE 1 IoCs

Processes:

joeevi.exe

pid process

2208 joeevi.exe

Loads dropped DLL 2 IoCs

Processes:

ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe

pid	process
2084	ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe
2084	ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

joeevi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /B"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /J"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /g"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /W"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /X"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /i"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /w"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /Z"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /I"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /x"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /f"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /R"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /E"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /c"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /v"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /d"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /M"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /k"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /Y"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /m"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /t"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /D"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /Q"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /O"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /A"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /l"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /b"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /y"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /j"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /e"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /F"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /K"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /C"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /z"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /S"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /L"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /n"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /h"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /s"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /N"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /u"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /V"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /G"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /a"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /H"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /o"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /U"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /q"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /p"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /r"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /P"	joeevi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\joeevi = "C:\\Users\\Admin\\joeevi.exe /T"	joeevi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

joeevi.exe

pid	process
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe
2208	joeevi.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exejoeevi.exe

pid process

2084 ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe
2208 joeevi.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe

description	pid	process	target process
PID 2084 wrote to memory of 2208	2084	ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe	joeevi.exe
PID 2084 wrote to memory of 2208	2084	ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe	joeevi.exe
PID 2084 wrote to memory of 2208	2084	ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe	joeevi.exe
PID 2084 wrote to memory of 2208	2084	ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe	joeevi.exe

C:\Users\Admin\AppData\Local\Temp\ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe
"C:\Users\Admin\AppData\Local\Temp\ddf521f481f58ad13f049d1d56a6c6790dcad66ebef0543eac70ebc51166d991.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084

C:\Users\Admin\joeevi.exe
"C:\Users\Admin\joeevi.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\joeevi.exe

Filesize
96KB

MD5
eb690c5248b8984d5a1da8363c8e8fdf

SHA1
e50d4eb3b8b52658b229b19ab011d37932a3efd6

SHA256
2df67ba1607a65381531c1f256b3a703e3815291e15a53028ec2967839eae31a

SHA512
94ee4fc6c9b0f103735920e8a9f56ccdf25db334267159ae47aa8fe4e2c117102b02bc1083f185017faa8874c28c6cc634117e6b577d4a2c9e2fdea2f69077ca

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads