Analysis
- max time kernel
67s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 05:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe
- Size 76KB
- Sample240603-ghv1aaeh24
- SHA256 fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e
- MD5 063773f38ecfc822fe68a9dd4b6d49ef
- SHA1 33489dbeeb7f49c5bb76aef2ee67d9fa6b45ba29
- SHA512 bf112f900ca3ecab450958b2b4ed247ab8ba92d4af075e0ea480d0f9cb30f63b9b6c5fa0203b83e4856467c6f089117af93a154d8a8872dbd68dd5b0d160e7d9
- SSDEEP 768:W+IrC6I+Kw+xOF4/i/BEYkp7P6lweQDhDmpU5GFrrEzWsdSE0d8pUHIkI0Io/:Wr+7xO+2G40OIkao/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" caoup.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe - Executes dropped EXE 1 IoCs
pid Process 916 caoup.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caoup = "C:\\Users\\Admin\\caoup.exe" caoup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe 916 caoup.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4228 fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe 916 caoup.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4228 wrote to memory of 916 4228 fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe 88 PID 4228 wrote to memory of 916 4228 fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe 88 PID 4228 wrote to memory of 916 4228 fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe"C:\Users\Admin\AppData\Local\Temp\fb982753c69e7e32cd1d34a71f157599c6e0c9aa41f0916b738cd1fe18c0af6e.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\caoup.exe"C:\Users\Admin\caoup.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\caoup.exe
- Size 76KB
- SHA256 411199ae2a1099615c095f8b480e3824113c27b4e5eb1747f730ed93f8207576
- MD5 f212d3a1eb2f20a2e07a1652d980cf76
- SHA1 6ccb9a23df4b281fc89d24d0e2c37a9c6b8edc50
- SHA512 0eaab5a81c7158034ada5d9bc2432efcabce1886b387cf3786c8996bff7e0daba73e639255201706aab3ebdd28ca53e76be81c7870982e36eb927fe7d63cf6bc
- SSDEEP 768:XOIrCWQPmQr+xOF4/i/BEYkp7P6lweQDhDmpU5GFrrEzWsdSE0d8pUHIkI0IeZ:X7GOxO+2G40OIkaeZ
- MD5 SHA1 SHA512 SSDEEP