Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe
Resource
win10v2004-20240226-en
General
-
Target
d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe
-
Size
184KB
-
MD5
4beb9268849a50fc0a83b068090653cc
-
SHA1
6f55749d15aa08e39fc3622b48b36f846d1e9772
-
SHA256
d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69
-
SHA512
ed2407c1beeb2f6b9c7d0eeb393bdec431c5a7a0a0aff98eb320e2f6e55bc0011f476156f8c146667d1a44c1e6a6268e7ffe9588fd50d7bd547d4028484caaae
-
SSDEEP
3072:7Ks+1cfl/BTyzcM+Knvmb7/D263i4qMbBQhAKIWOD2r1oX1/hcNcfAUane4RzsUf:2s0ClpTFzKnvmb7/D26y4qMSyKbOD2rR
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" reiroaw.exe -
Executes dropped EXE 1 IoCs
pid Process 2140 reiroaw.exe -
Loads dropped DLL 2 IoCs
pid Process 2960 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 2960 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /L" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /M" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /c" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /H" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /j" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /d" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /Z" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /U" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /e" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /z" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /E" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /k" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /y" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /A" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /Y" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /W" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /N" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /s" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /D" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /t" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /r" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /I" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /u" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /w" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /h" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /a" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /P" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /Q" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /J" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /T" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /K" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /R" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /o" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /l" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /g" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /V" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /b" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /p" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /F" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /i" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /p" d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /S" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /O" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /G" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /q" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /n" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /v" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /X" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /B" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /m" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /x" reiroaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiroaw = "C:\\Users\\Admin\\reiroaw.exe /C" reiroaw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe 2140 reiroaw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2960 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 2140 reiroaw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2140 2960 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 28 PID 2960 wrote to memory of 2140 2960 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 28 PID 2960 wrote to memory of 2140 2960 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 28 PID 2960 wrote to memory of 2140 2960 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe"C:\Users\Admin\AppData\Local\Temp\d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\reiroaw.exe"C:\Users\Admin\reiroaw.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD55c956adc6493c075d984d56b15486240
SHA10f0e2b17b728959d09e244289dbfdc83b109dc8a
SHA2565d38dce0cdd46c6847d46a2e39533daaea7eb36b54213931ad5cd1c342e4e74f
SHA5123cc7708ec781a534253c6c392eefdc3cb38f55012ebb406a953dd26b87889f27b29e75f1b58d12142bb28ae1d8179a337da55bc4ec5fa3748933ab9f5ec3611f