Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 23:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe
-
Size
60KB
-
MD5
14b9b8ba0d01cea215960d4da2a3c443
-
SHA1
e59f180479b5e022e9f96ea2470d8e99c782be00
-
SHA256
72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3
-
SHA512
a489ec94b215021b1ca6496ca9ccd681e80900f9a7f71527aee51df2c298b30f81af60d1000e70ed7aef0df31bb4ef02afd11e4739385dd5a6d7a4c6f1e9d15c
-
SSDEEP
1536:Qbx8w7vst+SbtS0SIImNMlsCSZxIG+UkHoM+:2vzRfloM
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" heuroem.exe -
Executes dropped EXE 1 IoCs
pid Process 3008 heuroem.exe -
Loads dropped DLL 2 IoCs
pid Process 2268 72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe 2268 72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /I" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /b" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /j" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /Y" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /J" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /d" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /q" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /E" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /n" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /A" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /h" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /P" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /S" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /M" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /U" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /e" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /T" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /F" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /y" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /H" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /s" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /k" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /R" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /G" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /u" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /f" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /w" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /C" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /Z" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /W" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /N" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /g" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /X" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /t" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /z" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /p" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /D" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /x" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /Q" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /o" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /O" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /a" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /V" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /B" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /v" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /c" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /K" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /l" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /L" heuroem.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\heuroem = "C:\\Users\\Admin\\heuroem.exe /i" heuroem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe 3008 heuroem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2268 72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe 3008 heuroem.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3008 2268 72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe 28 PID 2268 wrote to memory of 3008 2268 72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe 28 PID 2268 wrote to memory of 3008 2268 72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe 28 PID 2268 wrote to memory of 3008 2268 72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe 28 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27 PID 3008 wrote to memory of 2268 3008 heuroem.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe"C:\Users\Admin\AppData\Local\Temp\72ca660f42f9832c1f427310c771a031e69f1fd66bf561e3b8e268eb68b9ddd3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\heuroem.exe"C:\Users\Admin\heuroem.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD534a786abc93d90d744729afde680767f
SHA14311680b4e62f1b53a82c62248f95b723c4c051e
SHA256f6971638c2b3537f7545f6094b57b210e2bab39d285a1bf27f8ea54c837cb207
SHA5123048bda248b4a4d82e9b6868e1fda6bc33b3c70aa240e682d9460c5b9186a432f180eb7f5b4b61d413a323fe72be5b4fb9c907b844b4c3b4eca876012c6ff46d