Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 12:46
Static task
static1
Behavioral task
behavioral1
Sample
1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe
Resource
win10v20210410
General
-
Target
1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe
-
Size
1019KB
-
MD5
d80731db1bbef88fef86ecdb8ed74dc3
-
SHA1
e439a112d2cb675dc2989a5962f25a7eb4e53dd5
-
SHA256
1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47
-
SHA512
668ea73ee65a79f8a429fe70e51524c3d7499be4eca08626e22766384034b71eb2219936c72360caa96569ec5d9dafa511534a93a26b37b2ff920199116b0323
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\jmUYkwsw\\OCoEQUcc.exe," 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\jmUYkwsw\\OCoEQUcc.exe," 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe -
Modifies visibility of file extensions in Explorer 2 TTPs
-
Executes dropped EXE 4 IoCs
Processes:
dKscscsc.exeOCoEQUcc.exeHYYAoskY.exesetup.exepid process 3036 dKscscsc.exe 3524 OCoEQUcc.exe 4004 HYYAoskY.exe 2328 setup.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dKscscsc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation dKscscsc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
OCoEQUcc.exeHYYAoskY.exe1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exedKscscsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OCoEQUcc.exe = "C:\\ProgramData\\jmUYkwsw\\OCoEQUcc.exe" OCoEQUcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OCoEQUcc.exe = "C:\\ProgramData\\jmUYkwsw\\OCoEQUcc.exe" HYYAoskY.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\dKscscsc.exe = "C:\\Users\\Admin\\cmgwUEow\\dKscscsc.exe" 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OCoEQUcc.exe = "C:\\ProgramData\\jmUYkwsw\\OCoEQUcc.exe" 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\dKscscsc.exe = "C:\\Users\\Admin\\cmgwUEow\\dKscscsc.exe" dKscscsc.exe -
Drops file in System32 directory 7 IoCs
Processes:
dKscscsc.exeHYYAoskY.exedescription ioc process File opened for modification C:\Windows\SysWOW64\sheSwitchReceive.rar dKscscsc.exe File opened for modification C:\Windows\SysWOW64\sheUnprotectSearch.bmp dKscscsc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\cmgwUEow HYYAoskY.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\cmgwUEow\dKscscsc HYYAoskY.exe File created C:\Windows\SysWOW64\shell32.dll.exe dKscscsc.exe File opened for modification C:\Windows\SysWOW64\shePingAdd.jpeg dKscscsc.exe File opened for modification C:\Windows\SysWOW64\sheRequestLock.xls dKscscsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exedKscscsc.exepid process 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dKscscsc.exepid process 3036 dKscscsc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
dKscscsc.exepid process 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe 3036 dKscscsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
setup.exepid process 2328 setup.exe 2328 setup.exe 2328 setup.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.execmd.exedescription pid process target process PID 2116 wrote to memory of 3036 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe dKscscsc.exe PID 2116 wrote to memory of 3036 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe dKscscsc.exe PID 2116 wrote to memory of 3036 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe dKscscsc.exe PID 2116 wrote to memory of 3524 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe OCoEQUcc.exe PID 2116 wrote to memory of 3524 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe OCoEQUcc.exe PID 2116 wrote to memory of 3524 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe OCoEQUcc.exe PID 2116 wrote to memory of 3140 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe cmd.exe PID 2116 wrote to memory of 3140 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe cmd.exe PID 2116 wrote to memory of 3140 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe cmd.exe PID 2116 wrote to memory of 2444 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe reg.exe PID 2116 wrote to memory of 2444 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe reg.exe PID 2116 wrote to memory of 2444 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe reg.exe PID 2116 wrote to memory of 1972 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe reg.exe PID 2116 wrote to memory of 1972 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe reg.exe PID 2116 wrote to memory of 1972 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe reg.exe PID 2116 wrote to memory of 3840 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe reg.exe PID 2116 wrote to memory of 3840 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe reg.exe PID 2116 wrote to memory of 3840 2116 1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe reg.exe PID 3140 wrote to memory of 2328 3140 cmd.exe setup.exe PID 3140 wrote to memory of 2328 3140 cmd.exe setup.exe PID 3140 wrote to memory of 2328 3140 cmd.exe setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe"C:\Users\Admin\AppData\Local\Temp\1edf2704fcf6ca4b13ba4b06a5b2ece770a9465391e527d9bc08689ccf1b8e47.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\cmgwUEow\dKscscsc.exe"C:\Users\Admin\cmgwUEow\dKscscsc.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\jmUYkwsw\OCoEQUcc.exe"C:\ProgramData\jmUYkwsw\OCoEQUcc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\setup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
C:\ProgramData\WKIYsgAY\HYYAoskY.exeC:\ProgramData\WKIYsgAY\HYYAoskY.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\WKIYsgAY\HYYAoskY.exeMD5
0a5c49b89fd7091404915ba4db00b113
SHA18851fd6914cdb9857618491b2893f4f20154becc
SHA25684a4fa384f1e9123c6a87b211905441976e657af22310f78137036d64094c3ae
SHA5128a17a9dc2ad6495c6e6b8ef9833f17cf139d6304bf6d9f987f3860e7e247935781975e4ceeae1c8479fec7be13a2d35589a123d70065b6381652e12b056d08a3
-
C:\ProgramData\WKIYsgAY\HYYAoskY.exeMD5
0a5c49b89fd7091404915ba4db00b113
SHA18851fd6914cdb9857618491b2893f4f20154becc
SHA25684a4fa384f1e9123c6a87b211905441976e657af22310f78137036d64094c3ae
SHA5128a17a9dc2ad6495c6e6b8ef9833f17cf139d6304bf6d9f987f3860e7e247935781975e4ceeae1c8479fec7be13a2d35589a123d70065b6381652e12b056d08a3
-
C:\ProgramData\jmUYkwsw\OCoEQUcc.exeMD5
fad6d3b60dc1f126b867c8c2da6cef71
SHA1f9be6dee3195e8f65e62b629405ba4f83a806dce
SHA256c301da7113dd94950ddd5d5c5c2634077e29d6a0e51c94fdd237b75f48ec3c53
SHA51217c6ad445c43c3d0cc66ea67b0ce7e92fd3c7dd6158c96c1cb50494a8fca3048dfed187f495e17f973b97c774c64bf4ab812b813fdeb2b6144a5fb56c299178d
-
C:\ProgramData\jmUYkwsw\OCoEQUcc.exeMD5
fad6d3b60dc1f126b867c8c2da6cef71
SHA1f9be6dee3195e8f65e62b629405ba4f83a806dce
SHA256c301da7113dd94950ddd5d5c5c2634077e29d6a0e51c94fdd237b75f48ec3c53
SHA51217c6ad445c43c3d0cc66ea67b0ce7e92fd3c7dd6158c96c1cb50494a8fca3048dfed187f495e17f973b97c774c64bf4ab812b813fdeb2b6144a5fb56c299178d
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
7c02f4ea3ea05524631db43cef2e0bfb
SHA1f4a33008e5040faaf32ab995a11b91c16e80a46b
SHA256bd38517adb5b8e86ae8543f860bda1284f0ba1c006923fbb582551e7502d908e
SHA51222ba4621f66384005502ddeb117afd6b042368f9a6f537cc16037925104181679f63fe4cd9da0236ee4f741aaf181b95d29af311b762e3e18d75867c794ccec7
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
7c02f4ea3ea05524631db43cef2e0bfb
SHA1f4a33008e5040faaf32ab995a11b91c16e80a46b
SHA256bd38517adb5b8e86ae8543f860bda1284f0ba1c006923fbb582551e7502d908e
SHA51222ba4621f66384005502ddeb117afd6b042368f9a6f537cc16037925104181679f63fe4cd9da0236ee4f741aaf181b95d29af311b762e3e18d75867c794ccec7
-
C:\Users\Admin\cmgwUEow\dKscscsc.exeMD5
238d44689875a30cc81593d65bc3c83d
SHA11e70f8285c73a0b9d0111baa62e0537466b7119e
SHA2569b9a7a86ae87976495a2b3495420651a185a5a9d0bed10d43fc570874fed93e3
SHA512c99a1a8e9a2b294b76f9f8a51f8341c8788e6bc6e850fb8aff407ddf9e8d666f1b0ede4deb865c619d5dbfce5a248aa91bd3fb4235b4503acb27fb06371b817d
-
C:\Users\Admin\cmgwUEow\dKscscsc.exeMD5
238d44689875a30cc81593d65bc3c83d
SHA11e70f8285c73a0b9d0111baa62e0537466b7119e
SHA2569b9a7a86ae87976495a2b3495420651a185a5a9d0bed10d43fc570874fed93e3
SHA512c99a1a8e9a2b294b76f9f8a51f8341c8788e6bc6e850fb8aff407ddf9e8d666f1b0ede4deb865c619d5dbfce5a248aa91bd3fb4235b4503acb27fb06371b817d
-
memory/1972-124-0x0000000000000000-mapping.dmp
-
memory/2328-126-0x0000000000000000-mapping.dmp
-
memory/2444-123-0x0000000000000000-mapping.dmp
-
memory/3036-114-0x0000000000000000-mapping.dmp
-
memory/3140-122-0x0000000000000000-mapping.dmp
-
memory/3524-117-0x0000000000000000-mapping.dmp
-
memory/3840-125-0x0000000000000000-mapping.dmp