Analysis
-
max time kernel
119s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 04:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe
-
Size
88KB
-
MD5
5b0c66fb06a1a79ca2196f43f8a74bb0
-
SHA1
1287b85e4a9ad2b982097919f3d8a33c2aba1866
-
SHA256
dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54
-
SHA512
c32eb9437e8de90e52d11c0ed4dd64f04ea8238a0680fc641bd83f290f6139405be3ec7ee9980913bbfc0acbacbebd2aeff4fc42f5528a16ee0a3c91e5fae677
-
SSDEEP
768:vAT68qOJ+TtRqIwHpFeh6gM1rA8dOsc7jUq4RkA5o3K1DfsvtzsXjLft+9o1mm:vATHqlZ0LFjnAzA5o6BfItoXjLl0hm
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tueob.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe -
Executes dropped EXE 1 IoCs
pid Process 1952 tueob.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /m" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /r" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /a" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /s" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /w" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /e" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /g" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /q" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /b" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /v" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /z" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /h" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /f" dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /c" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /k" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /u" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /j" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /n" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /i" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /f" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /o" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /p" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /y" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /x" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /d" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /l" tueob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tueob = "C:\\Users\\Admin\\tueob.exe /t" tueob.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tueob.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3116 dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe 3116 dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe 1952 tueob.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3116 dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe 1952 tueob.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3116 wrote to memory of 1952 3116 dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe 86 PID 3116 wrote to memory of 1952 3116 dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe 86 PID 3116 wrote to memory of 1952 3116 dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe"C:\Users\Admin\AppData\Local\Temp\dce279dcd45f511a3b2a3917c6990306cf0b19e36e72f29a932a605bfc0a6d54N.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\tueob.exe"C:\Users\Admin\tueob.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1952
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5bfa5240453cc61a8024acdae196f5bd9
SHA178782992be3178b5abe7f17b62330540ef9bf965
SHA2564ac45177e6efb871d7ae4cf94b8e6568fb860c9ca1f5da8b313636d01e6fbecc
SHA5120386f83bb6774b78959fb37252b310f8ba268ec969bc90d860f249d2f4c47d73e8e3850dc5545badbf0f9f0da501a2078a854c3974dd81c5c65af893e628dfe1