Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 02:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17a71e61f3b7dd0fd0c7ec8211baecc4.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
17a71e61f3b7dd0fd0c7ec8211baecc4.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
17a71e61f3b7dd0fd0c7ec8211baecc4.exe
-
Size
156KB
-
MD5
17a71e61f3b7dd0fd0c7ec8211baecc4
-
SHA1
2068268f94f56a0f50e7793fc06e93c0b66304d8
-
SHA256
81fdd2d8897b403ad1f2f7492432c31f108577188a3955768235fdd75fc1619d
-
SHA512
1c299982ed990712bf99da205de90c4d83df2e9e4036367c37bee46358fd6041334c82f33fa952e7ac396b4333ae525af3ef35f570dd4849d97dd3e6d9d53426
-
SSDEEP
3072:oBd1jE2MtU7Qv0w4ZRRQMMDwtIMCeFP4ANV4oQZiEWv9:6dpE2R7Qvb4tQTaCeFP4ABW4
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 17a71e61f3b7dd0fd0c7ec8211baecc4.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rpweum.exe -
Executes dropped EXE 1 IoCs
pid Process 2568 rpweum.exe -
Loads dropped DLL 2 IoCs
pid Process 2396 17a71e61f3b7dd0fd0c7ec8211baecc4.exe 2396 17a71e61f3b7dd0fd0c7ec8211baecc4.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /k" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /u" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /d" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /R" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /Z" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /E" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /b" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /S" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /W" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /s" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /P" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /I" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /x" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /f" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /a" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /r" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /T" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /M" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /l" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /i" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /L" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /O" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /U" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /y" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /v" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /w" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /N" 17a71e61f3b7dd0fd0c7ec8211baecc4.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /K" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /V" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /Y" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /p" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /F" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /C" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /N" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /X" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /g" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /G" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /e" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /J" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /m" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /Q" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /A" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /D" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /B" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /n" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /t" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /z" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /H" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /j" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /q" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /o" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /c" rpweum.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpweum = "C:\\Users\\Admin\\rpweum.exe /h" rpweum.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2396 17a71e61f3b7dd0fd0c7ec8211baecc4.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe 2568 rpweum.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2396 17a71e61f3b7dd0fd0c7ec8211baecc4.exe 2568 rpweum.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2568 2396 17a71e61f3b7dd0fd0c7ec8211baecc4.exe 28 PID 2396 wrote to memory of 2568 2396 17a71e61f3b7dd0fd0c7ec8211baecc4.exe 28 PID 2396 wrote to memory of 2568 2396 17a71e61f3b7dd0fd0c7ec8211baecc4.exe 28 PID 2396 wrote to memory of 2568 2396 17a71e61f3b7dd0fd0c7ec8211baecc4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a71e61f3b7dd0fd0c7ec8211baecc4.exe"C:\Users\Admin\AppData\Local\Temp\17a71e61f3b7dd0fd0c7ec8211baecc4.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\rpweum.exe"C:\Users\Admin\rpweum.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5d910f8b1e64090d0c3e02faadf05e2c8
SHA158facc5dcd626e09ddf2ae9c2a61af8125e935ef
SHA2563891b7dc6e45e2b95dfc152476eb82ae9615a19ec00d0a6fd7047b8f80c102b4
SHA5122b92ba2b6effbe2bd02c2f9f9313b5f844c03735637bad9ba9ba9316a88f47ab39d1aba52a5de75b09da86480ff14d0be9a9cdb2e9ebfb6b14b4be239c385343