922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f

General

Target

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
Size

296KB
MD5

4600f8268ca884c291b391dda25849d0
SHA1

dcff33757d2a54f381e6eb498a84dbcf540dc774
SHA256

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f
SHA512

c3203ab728e96dfe8257bf60da608feae27e4ee55e5fb01df9c569a5b44868530b8485d1cf49aa0992b7de08b1993a1dba783230f5fb17df5fc2f25591a6bde2
SSDEEP

6144:uV5tdO1V0uKnvmb7/D26CVrBROjD8R4F0jI+UNc5ynagM/eSpbN1AyllZI4DS7Yq:untdO1V0uKnvmb7/D26lD8R4F0jI+UNN

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exekiujaw.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kiujaw.exe

Executes dropped EXE 1 IoCs

Processes:

kiujaw.exe

pid process

2720 kiujaw.exe

pid	process
2720	kiujaw.exe

Loads dropped DLL 2 IoCs

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe

pid	process
844	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
844	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

kiujaw.exe922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /Q"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /y"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /M"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /f"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /C"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /o"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /c"	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /A"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /m"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /z"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /c"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /w"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /b"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /i"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /J"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /s"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /G"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /P"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /X"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /S"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /j"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /h"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /W"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /e"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /q"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /v"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /B"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /Y"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /D"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /x"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /K"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /V"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /I"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /k"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /u"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /R"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /O"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /r"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /n"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /U"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /g"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /H"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /L"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /l"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /E"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /F"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /p"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /a"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /t"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /N"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /Z"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /d"	kiujaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiujaw = "C:\\Users\\Admin\\kiujaw.exe /T"	kiujaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exekiujaw.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kiujaw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exekiujaw.exe

pid	process
844	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe
2720	kiujaw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exekiujaw.exe

pid process

844 922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
2720 kiujaw.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe

description	pid	process	target process
PID 844 wrote to memory of 2720	844	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe	kiujaw.exe
PID 844 wrote to memory of 2720	844	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe	kiujaw.exe
PID 844 wrote to memory of 2720	844	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe	kiujaw.exe
PID 844 wrote to memory of 2720	844	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe	kiujaw.exe

C:\Users\Admin\AppData\Local\Temp\922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
"C:\Users\Admin\AppData\Local\Temp\922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\kiujaw.exe
  "C:\Users\Admin\kiujaw.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\kiujaw.exe

Filesize
296KB

MD5
5355dfd4abd0c1ebc0ff6910e0f54525

SHA1
1cef05bd33ebcda705afeb6c90e65d91dc8bf54b

SHA256
08e2d14c2f248f2857c18ff9004ced296df74ac300f40e71c864a0538db947ee

SHA512
8c21994c8176dd572bb9bb2682f7b111be536cdd7ff9f271a47d31920e759e8a7503ea5cda0a7f484c78182110381baeefea546b63a263e2f95a004fc52b7288

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads