Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 05:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe
-
Size
296KB
-
MD5
01eef24d9bdcd750d756c5e8a08b2900
-
SHA1
3bd5d15aa29289327e2dbfb7de902373094de9d2
-
SHA256
12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1a
-
SHA512
fcbc4a8d87b622fb8e8b0981e7d44023ca98e2514b99a6e7275e62d140e0e4855928f06eb92bb76274bfb132c160180d85b7b9ac204737d6ce904b8cabc0016d
-
SSDEEP
6144:72iFRsJcCf2lfKgO32mO1IdifegrSQOJMmSnxtAPUWJj9/P/oEAlu9UY6LxP:7hUTfqmjZHJFnPnp6l2U1P
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mikuh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe -
Executes dropped EXE 1 IoCs
pid Process 3528 mikuh.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /h" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /d" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /n" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /l" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /b" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /z" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /w" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /x" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /v" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /y" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /c" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /i" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /r" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /t" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /e" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /f" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /u" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /g" 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /k" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /j" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /a" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /p" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /g" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /q" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /o" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /s" mikuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mikuh = "C:\\Users\\Admin\\mikuh.exe /m" mikuh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mikuh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2708 svchost.exe 2848 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1528 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe 1528 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe 3528 mikuh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1528 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe 3528 mikuh.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1528 wrote to memory of 3528 1528 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe 84 PID 1528 wrote to memory of 3528 1528 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe 84 PID 1528 wrote to memory of 3528 1528 12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe"C:\Users\Admin\AppData\Local\Temp\12071c161bcef3d371fb232edaaa0f88f5cf89bb07e6bd466e2bc903bd52bf1aN.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\mikuh.exe"C:\Users\Admin\mikuh.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3528
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:2708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:2848
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD5a572a61f3a4c454ae4afe1ac73684f11
SHA1cc2209e6ff5870fb1e92a539f36bc80ca6ddf8d9
SHA256955fa86717b1a0f1e349fc3176974d6466970defa5648ffb379c4fc651e50c1b
SHA512d37c2910338660a1a4d284488594fdce3214bc5e8857a2e6ed9d9045b4ca22fb2cd83c03a952cbedd9d7b36d9759446e3eec9b200c15f1510801e44e843e0f4e