fceea0cd8b2b0ed98eb55cd6713de63319b944c438b92ccbd4b38e299d4af1ed

Analysis

max time kernel
302s
max time network
1724s
platform
windows10_x64
resource
win10v20210408
submitted
11-07-2021 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

keygen-step-5.exe
Size

1.1MB
MD5

747f74fabfd75d98062a485981249675
SHA1

ae0f1726911463f6711f0f4077aaf0675e0f732a
SHA256

21517fbbdbdf6d0b77e35c00736adbeb025cb7050792ada79fb534c5733298c0
SHA512

7b790e759ea136534624366b693bf9f27919f58d987490500db0bd2ffba1406196fb0ec7c8e5121f8347f9aab49ef9f0c813025a19183d772e68f5350dccac4e

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Ee_SxWP.ExE

pid process

1220 Ee_SxWP.ExE
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

508 regsvr32.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

regsvr32.exe

pid process

508 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2952 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2952 taskkill.exe

pid	process
1220	Ee_SxWP.ExE

pid	process
508	regsvr32.exe

pid	process
508	regsvr32.exe

pid	process
2952	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2952	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

keygen-step-5.execmd.exeEe_SxWP.ExEcmd.exe

description	pid	process	target process
PID 1456 wrote to memory of 1128	1456	keygen-step-5.exe	cmd.exe
PID 1456 wrote to memory of 1128	1456	keygen-step-5.exe	cmd.exe
PID 1456 wrote to memory of 1128	1456	keygen-step-5.exe	cmd.exe
PID 1128 wrote to memory of 1220	1128	cmd.exe	Ee_SxWP.ExE
PID 1128 wrote to memory of 1220	1128	cmd.exe	Ee_SxWP.ExE
PID 1128 wrote to memory of 1220	1128	cmd.exe	Ee_SxWP.ExE
PID 1128 wrote to memory of 2952	1128	cmd.exe	taskkill.exe
PID 1128 wrote to memory of 2952	1128	cmd.exe	taskkill.exe
PID 1128 wrote to memory of 2952	1128	cmd.exe	taskkill.exe
PID 1220 wrote to memory of 804	1220	Ee_SxWP.ExE	cmd.exe
PID 1220 wrote to memory of 804	1220	Ee_SxWP.ExE	cmd.exe
PID 1220 wrote to memory of 804	1220	Ee_SxWP.ExE	cmd.exe
PID 1220 wrote to memory of 2184	1220	Ee_SxWP.ExE	cmd.exe
PID 1220 wrote to memory of 2184	1220	Ee_SxWP.ExE	cmd.exe
PID 1220 wrote to memory of 2184	1220	Ee_SxWP.ExE	cmd.exe
PID 2184 wrote to memory of 604	2184	cmd.exe	cmd.exe
PID 2184 wrote to memory of 604	2184	cmd.exe	cmd.exe
PID 2184 wrote to memory of 604	2184	cmd.exe	cmd.exe
PID 2184 wrote to memory of 3940	2184	cmd.exe	cmd.exe
PID 2184 wrote to memory of 3940	2184	cmd.exe	cmd.exe
PID 2184 wrote to memory of 3940	2184	cmd.exe	cmd.exe
PID 2184 wrote to memory of 508	2184	cmd.exe	regsvr32.exe
PID 2184 wrote to memory of 508	2184	cmd.exe	regsvr32.exe
PID 2184 wrote to memory of 508	2184	cmd.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\keygen-step-5.exe
"C:\Users\Admin\AppData\Local\Temp\keygen-step-5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C CopY /y"C:\Users\Admin\AppData\Local\Temp\keygen-step-5.exe" ..\Ee_SxWP.ExE> nUl &&START ..\EE_sxWP.ExE /pyJcP63I6SaeVP58 &iF"" == "" for %zin ( "C:\Users\Admin\AppData\Local\Temp\keygen-step-5.exe" ) do taskkill /F -im "%~nXz" > nUl
2⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Users\Admin\AppData\Local\Temp\Ee_SxWP.ExE
..\EE_sxWP.ExE /pyJcP63I6SaeVP58
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C CopY /y"C:\Users\Admin\AppData\Local\Temp\Ee_SxWP.ExE" ..\Ee_SxWP.ExE> nUl &&START ..\EE_sxWP.ExE /pyJcP63I6SaeVP58 &iF"/pyJcP63I6SaeVP58 " == "" for %zin ( "C:\Users\Admin\AppData\Local\Temp\Ee_SxWP.ExE" ) do taskkill /F -im "%~nXz" > nUl
4⤵
PID:804

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c eChO Sl%RAnDom%b~C:\Users\Admin\AppData\Local\TempQ7C:\Users\Admin\AppData\Local\Tempn91> D7eYTR7e.XlX & eCho | sET /p = "MZ" > 85eRUS.S& Copy/Y /B 85erUs.S + K3w0pUAv.Bm + 7KOV.ZNS + EXQJRWMh.T + 1GLEMCQ.a + B~FB768.3_H + FKIlLQgE._ + YFp7m._OF + UzRt7.T1 +FNh1Wg6.Px8+ FKQURPz.6X8 +kWjJB5.HP + rX8pQRM.lR+ D7eYTR7E.XLX ..\oZIe4.4p>nuL & dEL /Q * > nUL&stArt regsvr32 ..\oZIE4.4P /s
4⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCho "
5⤵
PID:604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" sET /p = "MZ" 1>85eRUS.S"
5⤵
PID:3940

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 ..\oZIE4.4P /s
5⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:508

C:\Windows\SysWOW64\taskkill.exe
taskkill /F -im "keygen-step-5.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2952

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ee_SxWP.ExE
MD5
747f74fabfd75d98062a485981249675

SHA1
ae0f1726911463f6711f0f4077aaf0675e0f732a

SHA256
21517fbbdbdf6d0b77e35c00736adbeb025cb7050792ada79fb534c5733298c0

SHA512
7b790e759ea136534624366b693bf9f27919f58d987490500db0bd2ffba1406196fb0ec7c8e5121f8347f9aab49ef9f0c813025a19183d772e68f5350dccac4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ee_SxWP.ExE
MD5
747f74fabfd75d98062a485981249675

SHA1
ae0f1726911463f6711f0f4077aaf0675e0f732a

SHA256
21517fbbdbdf6d0b77e35c00736adbeb025cb7050792ada79fb534c5733298c0

SHA512
7b790e759ea136534624366b693bf9f27919f58d987490500db0bd2ffba1406196fb0ec7c8e5121f8347f9aab49ef9f0c813025a19183d772e68f5350dccac4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\1GLeMCq.a
MD5
2f40294d2446b8074f9a2872766ac0c0

SHA1
70a76f08d84425b1c913783db3c0aa31a72d85f8

SHA256
51fa5a0360075fb4ea66ee8d839def7d05a274230e7c24b4eeef83136d3a7e98

SHA512
2c7d714de3de2a037810c63ad0956581e6de339d079531083f2b0de2cedeb2be3c91bb707e6e3c4ba1643942e08b73f76c53f9d2dfcf45f14255a29acd47b4ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\7koV.zNs
MD5
0a530d6c84051ba82073cfb26d7bdf5d

SHA1
81f8d160f7d0dc87e228994d63bc2fb5fa555134

SHA256
9233aa84477b2ba3bfa971fc7eb5613fd479999e6800c734d408996b9a74aeb6

SHA512
7bd5efa3c56e8eb60c5897bf8268a4f2a9c6fa615ecca4bc2b3425b8fe4f42e0c91e9ba9a656ddfa935fc1b7e753c1500494b18ee4a6c45f6c4c5b15d99780e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\85eRUS.S
MD5
ac6ad5d9b99757c3a878f2d275ace198

SHA1
439baa1b33514fb81632aaf44d16a9378c5664fc

SHA256
9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d

SHA512
bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\EXqJRWMh.T
MD5
c3ab882cb9bfe35a8c19133e83d07d41

SHA1
4e9a8f991248cac978f649cf674a772553fe2c0d

SHA256
99efe31a4f8b36a887c640c6049c4bd7112dda7a4986be3afe0c50f0f50a7cfb

SHA512
ef10ce9fe510da13b68dcc93034ac6fb1bac83a9ce035938af0c38911fc7c5f77774ba025a21d086791ce0e811000bdda68b1dc35821a6d9cd82652b76c2f1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\FKilLQge._
MD5
9edf0359b4f5dc3fb9dcb01163f51d47

SHA1
a562f422ed8a9a7a20c63ed0e6c6865b224b2566

SHA256
81544954e0da023a998868b7e9108202ade8e6f9738d180bbf5304b1bfec4b47

SHA512
6cd0d076545a958ad1162d1486bae9a54bfdcc5493db5e23960a40430c986c0d81484cd2311764da99824f008aecbb87b2e9c846ca4c116278f8236aa4f84c00

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\FNh1Wg6.Px8
MD5
ddec222bb7b12164d815b00c28c7eebb

SHA1
049dd6260ccb115d4d1a725decad59c47356959f

SHA256
ff3feacaa942ea7feb8d6b14cdd2aadc208583f023e612d97534333335f869aa

SHA512
1479411e92915a5a083f463de4b8410404c3b7207868a5c6aef3e7cda63a658b8795c7e4a513c2896d4cd5051ade0fe786afd6f6cc01e9adbbca4a78884b89f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\b~FB768.3_h
MD5
42ce37cb43a9640686f7eb00777f093d

SHA1
860249c320c159ed311763ba80617e84030adbac

SHA256
57f0652f473a30341fec445559c28e58e2fa437e7eb1f3ac3606a0050f8862a6

SHA512
a0c7191140fab59e551752e28252c2eb1f90664aab734edffeb584f2547528bc1f89192e3abd71b93bd94cf2e7bfebe2e99607ea3461b0fdfa365251ebf71bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\fKqURPz.6x8
MD5
c2115b894512d75d4f2abca6d35eb857

SHA1
1748fc0c269a6c3e24c6aae878eb7ad99e78d908

SHA256
625a388cdd06fad938da13d84452a214c24af56737eeda6cc382f22f22ea6fe7

SHA512
d0618680c52a478948c3f8f3af617ea848aa083d9c72b464a11fb6d72891873e828612674c648cce641ee667c42bca37e08866bcac2da7ddd641f1bed2f40e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\k3w0puAv.bm
MD5
23ccc964fe6f303f7895bcd44a198824

SHA1
b15dd3e4d469567ef4400584a2c25e09d693bcd2

SHA256
43820768d00b3e718e23b10cef1d51ca69372ed845307ce9e52acd5bb4a43bac

SHA512
17d4cb773cf990ba62054e784c6572c2b0aaaf1d937d7bf1e1b086dbd346dab7d43902b04179afd4fd160059c7a57a6e923721e44661bae52d0bffaadf93ec9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\kwjJB5.Hp
MD5
cc73d1e911c166dbcd78282dc347f87e

SHA1
91bb48fc7dcfc0002c64eaaa1a7e2b77ff1f8d17

SHA256
1505ebabaaaf7aa27f6f550d4e8fc9bd50ae471cc2040467b4054e2617ec3c6a

SHA512
17476da0429752ba1aa198044ef21cb6e31c16c67bb59d2cddf40dcc594e618a0db9bc0648d90be4c7157bfc04ba2e7adfa2de069a9c0e38478635bb86441c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\rX8pqRM.lR
MD5
3a0b90c9cb9df3427f0280a9119d24b6

SHA1
495d99e16070bfd0e0c62ca5fd2ba5806c528991

SHA256
3cc1dd0155637ba2a3b9a82dcb011ce3cdea794784bdd308903f696e76f4ddb1

SHA512
a23ad9597d91a97273bc6f87378021ecf14d1c882db8181c510938cb8434ed05dd929a8af2e8bf7c0d7affdb60cba149566d4f970e3f4daf3a2aa2a408da618f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\uzRt7.t1
MD5
53df1d38fb65cb44f4adf13275e24d27

SHA1
e201716331bcfb1dbfd8693d0d2537162f01ad2b

SHA256
2f3332a9c90b0f54da8497c144bae06d5167b10cd3280fe134b6da68cadad4a9

SHA512
6e5db981716bd693283458511f0943cba0521ff37b329c55c78b1b8c52edf580223c0381e847b73cce245a5307605478a457049408b3711f25f99c2824981c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\yFp7m._oF
MD5
fb09b4c1e4cb3f5e403d110ae6ebfff3

SHA1
d071d257fc12cbea09a356f7e33a5a540ab15d6d

SHA256
6c158e9ea3ad11d1b7422a5076ba93399069012c7545c601d9570314ae809e3d

SHA512
ce4d6e697349719af91a4837ee7bb295e644211211d6cedb74554c60b2ea847623cfa4bafcda99b744817e7d993373d24d90f8ddd940f7af085ccf99f286c9d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\oZIE4.4P
MD5
bc16df8a922b507ade3d5066590ae13a

SHA1
ac255f0b73ca2cbefb74655b9ea2ba92cf101453

SHA256
109f0754182947dcca199c2a4381566f55d3461484ae19264badf7e84bbe4ad5

SHA512
c69cf19f15bd2b3f5b2ed8eb8ae51b5aaf3c48751aca3a9751c6a29f394330f6603053b7be0cfa719fcf5bcd096f9b6abed5153c40a65a03c0d302477b5494d3

Download Submit
\Users\Admin\AppData\Local\Temp\oZIe4.4p
MD5
bc16df8a922b507ade3d5066590ae13a

SHA1
ac255f0b73ca2cbefb74655b9ea2ba92cf101453

SHA256
109f0754182947dcca199c2a4381566f55d3461484ae19264badf7e84bbe4ad5

SHA512
c69cf19f15bd2b3f5b2ed8eb8ae51b5aaf3c48751aca3a9751c6a29f394330f6603053b7be0cfa719fcf5bcd096f9b6abed5153c40a65a03c0d302477b5494d3

Download Submit
memory/508-145-0x00000000068B0000-0x000000000695C000-memory.dmp

Filesize
688KB

Download
memory/508-142-0x0000000003000000-0x000000000314A000-memory.dmp

Filesize
1.3MB

Download
memory/508-146-0x0000000006970000-0x0000000006A09000-memory.dmp

Filesize
612KB

Download
memory/508-144-0x00000000067F0000-0x00000000068A4000-memory.dmp

Filesize
720KB

Download
memory/508-143-0x0000000006640000-0x000000000672E000-memory.dmp

Filesize
952KB

Download
memory/508-139-0x0000000000000000-mapping.dmp

Download
memory/508-147-0x0000000006970000-0x0000000006A09000-memory.dmp

Filesize
612KB

Download
memory/604-124-0x0000000000000000-mapping.dmp

Download
memory/804-122-0x0000000000000000-mapping.dmp

Download
memory/1128-117-0x0000000000000000-mapping.dmp

Download
memory/1220-118-0x0000000000000000-mapping.dmp

Download
memory/2184-123-0x0000000000000000-mapping.dmp

Download
memory/2952-120-0x0000000000000000-mapping.dmp

Download
memory/3940-125-0x0000000000000000-mapping.dmp

Download