Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe
-
Size
100KB
-
MD5
fe06d0604f81d991a12db1dbe552c780
-
SHA1
8c853f93a13e4d59e717d74d91008e7cc80f2bfd
-
SHA256
6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdcc
-
SHA512
d7840d7bbb5657282315b2df090c3af786269724504bde67172e3ae6f49b16fc487753c456e41f30e39495a12454bdab68cae3991deb96910f87f41e5ef0e939
-
SSDEEP
1536:qTtG782NTzwgkHMGAc4ohrPXo+73Rez8b0SyZNIjN:rwgkaurPX7CZCN
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" taejoi.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe -
Executes dropped EXE 1 IoCs
pid Process 3052 taejoi.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /N" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /w" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /l" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /p" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /q" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /V" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /u" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /F" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /v" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /s" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /L" 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /Z" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /a" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /P" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /O" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /S" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /U" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /C" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /j" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /g" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /I" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /r" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /t" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /D" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /J" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /k" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /A" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /K" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /M" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /b" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /o" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /B" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /Y" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /G" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /L" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /z" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /c" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /n" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /e" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /X" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /Q" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /H" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /d" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /m" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /R" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /W" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /y" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /i" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /h" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /E" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /T" taejoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taejoi = "C:\\Users\\Admin\\taejoi.exe /x" taejoi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taejoi.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 636 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe 636 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe 3052 taejoi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 636 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe 3052 taejoi.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 636 wrote to memory of 3052 636 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe 93 PID 636 wrote to memory of 3052 636 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe 93 PID 636 wrote to memory of 3052 636 6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe"C:\Users\Admin\AppData\Local\Temp\6c12a7efe94c7487f08dc8598450da6e02d74d4d309628caac88957b8e68bdccN.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\taejoi.exe"C:\Users\Admin\taejoi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD55f6f2faf87e0435b2cfb5ce21461ccf4
SHA1a8ba23c3b763e30aa3ea5b43d4f3802898a9043c
SHA2564c822cbbbd1d0848eb3c9f2746b883e760c32fa246a8e90a5059faa4b3c9d146
SHA512659021cee1d01e2e6fc79439c3c249c6cdd6d290141ecf3aa04b0a25a9c3b1f80dfcc43ddd0b1020835bfa9d1ba760ff812da18d24bc6da14d08620985d25260