Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 00:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d58e48768ec8346bfb9055a15244fc70N.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
d58e48768ec8346bfb9055a15244fc70N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
d58e48768ec8346bfb9055a15244fc70N.exe
-
Size
228KB
-
MD5
d58e48768ec8346bfb9055a15244fc70
-
SHA1
20e24c57dd0ac68d1bf191e8c548bcb7b8592487
-
SHA256
c10d54e3e88c2c91abb28c1bfa8e29ec329d125e265bde164d93c22ec08cf68a
-
SHA512
7e2929f9d41626d2341267c5288b47d9c02e23f2a7e9fa406e6ff87bbac6acaf3ac2db25f7a6be8934b72673d852d80889c5e3eb8364f74bad5a37e2fce23802
-
SSDEEP
6144:zrmt3PFKs7aFwKWwalhrEqxF6snji81RUinKZHg/aSb:Pm5PhAmZIH+aa
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d58e48768ec8346bfb9055a15244fc70N.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zaeiqih.exe -
Executes dropped EXE 1 IoCs
pid Process 2420 zaeiqih.exe -
Loads dropped DLL 2 IoCs
pid Process 2960 d58e48768ec8346bfb9055a15244fc70N.exe 2960 d58e48768ec8346bfb9055a15244fc70N.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /r" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /d" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /z" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /m" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /i" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /s" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /w" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /p" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /c" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /t" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /f" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /g" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /v" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /o" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /k" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /l" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /q" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /u" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /a" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /n" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /b" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /x" d58e48768ec8346bfb9055a15244fc70N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /h" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /y" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /e" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /x" zaeiqih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaeiqih = "C:\\Users\\Admin\\zaeiqih.exe /j" zaeiqih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaeiqih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d58e48768ec8346bfb9055a15244fc70N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 d58e48768ec8346bfb9055a15244fc70N.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe 2420 zaeiqih.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2960 d58e48768ec8346bfb9055a15244fc70N.exe 2420 zaeiqih.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2420 2960 d58e48768ec8346bfb9055a15244fc70N.exe 28 PID 2960 wrote to memory of 2420 2960 d58e48768ec8346bfb9055a15244fc70N.exe 28 PID 2960 wrote to memory of 2420 2960 d58e48768ec8346bfb9055a15244fc70N.exe 28 PID 2960 wrote to memory of 2420 2960 d58e48768ec8346bfb9055a15244fc70N.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d58e48768ec8346bfb9055a15244fc70N.exe"C:\Users\Admin\AppData\Local\Temp\d58e48768ec8346bfb9055a15244fc70N.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\zaeiqih.exe"C:\Users\Admin\zaeiqih.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2420
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5dbe48857f2a12cf3be8cd26ca09d3d85
SHA1746ebb12b1880bcaacfcf7d0bf8cad5ae1089965
SHA256cd66e83a922a27427877bce5d525e19720accd916c75f7a9bb1441eaad6b56ac
SHA51273060f3a08a6309c94d505f8d3b7ea034c8e78c8cfd02e5330f9dfe9dc855d36d966a38acdd881423be8001d8ccee2e9596ae2700e1924347214ed6a0198dff0