Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-05-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe
Resource
win7-20220414-en
General
-
Target
90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe
-
Size
302KB
-
MD5
a359f00c1f48a7d4bb1eb05ad9a2fe3f
-
SHA1
053733b31efcab28d6548a9edbf03e963b43b18c
-
SHA256
90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3
-
SHA512
a2e3731c3e80e890e768a18fc8ca4a9c40b1486b4f1729b32d36df7870885c5da36942f1c0a0c3c0187b8404d1c3fcab8a61e620bf3717e7fe9f7bcc343c6542
Malware Config
Extracted
amadey
3.05
wecrack.su/fkwdoXScn2/index.php
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
ftewk.exeftewk.exeftewk.exeftewk.exepid process 828 ftewk.exe 1044 ftewk.exe 1536 ftewk.exe 1980 ftewk.exe -
Loads dropped DLL 2 IoCs
Processes:
90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exepid process 1400 90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe 1400 90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exeftewk.execmd.exetaskeng.exedescription pid process target process PID 1400 wrote to memory of 828 1400 90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe ftewk.exe PID 1400 wrote to memory of 828 1400 90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe ftewk.exe PID 1400 wrote to memory of 828 1400 90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe ftewk.exe PID 1400 wrote to memory of 828 1400 90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe ftewk.exe PID 828 wrote to memory of 904 828 ftewk.exe cmd.exe PID 828 wrote to memory of 904 828 ftewk.exe cmd.exe PID 828 wrote to memory of 904 828 ftewk.exe cmd.exe PID 828 wrote to memory of 904 828 ftewk.exe cmd.exe PID 828 wrote to memory of 1628 828 ftewk.exe schtasks.exe PID 828 wrote to memory of 1628 828 ftewk.exe schtasks.exe PID 828 wrote to memory of 1628 828 ftewk.exe schtasks.exe PID 828 wrote to memory of 1628 828 ftewk.exe schtasks.exe PID 904 wrote to memory of 1704 904 cmd.exe reg.exe PID 904 wrote to memory of 1704 904 cmd.exe reg.exe PID 904 wrote to memory of 1704 904 cmd.exe reg.exe PID 904 wrote to memory of 1704 904 cmd.exe reg.exe PID 1556 wrote to memory of 1044 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1044 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1044 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1044 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1536 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1536 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1536 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1536 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1980 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1980 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1980 1556 taskeng.exe ftewk.exe PID 1556 wrote to memory of 1980 1556 taskeng.exe ftewk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe"C:\Users\Admin\AppData\Local\Temp\90cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exe"C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {E18C7E20-2427-456D-893B-6B347A33BB10} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeC:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeC:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeC:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeFilesize
302KB
MD5a359f00c1f48a7d4bb1eb05ad9a2fe3f
SHA1053733b31efcab28d6548a9edbf03e963b43b18c
SHA25690cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3
SHA512a2e3731c3e80e890e768a18fc8ca4a9c40b1486b4f1729b32d36df7870885c5da36942f1c0a0c3c0187b8404d1c3fcab8a61e620bf3717e7fe9f7bcc343c6542
-
C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeFilesize
302KB
MD5a359f00c1f48a7d4bb1eb05ad9a2fe3f
SHA1053733b31efcab28d6548a9edbf03e963b43b18c
SHA25690cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3
SHA512a2e3731c3e80e890e768a18fc8ca4a9c40b1486b4f1729b32d36df7870885c5da36942f1c0a0c3c0187b8404d1c3fcab8a61e620bf3717e7fe9f7bcc343c6542
-
C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeFilesize
302KB
MD5a359f00c1f48a7d4bb1eb05ad9a2fe3f
SHA1053733b31efcab28d6548a9edbf03e963b43b18c
SHA25690cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3
SHA512a2e3731c3e80e890e768a18fc8ca4a9c40b1486b4f1729b32d36df7870885c5da36942f1c0a0c3c0187b8404d1c3fcab8a61e620bf3717e7fe9f7bcc343c6542
-
C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeFilesize
302KB
MD5a359f00c1f48a7d4bb1eb05ad9a2fe3f
SHA1053733b31efcab28d6548a9edbf03e963b43b18c
SHA25690cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3
SHA512a2e3731c3e80e890e768a18fc8ca4a9c40b1486b4f1729b32d36df7870885c5da36942f1c0a0c3c0187b8404d1c3fcab8a61e620bf3717e7fe9f7bcc343c6542
-
C:\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeFilesize
302KB
MD5a359f00c1f48a7d4bb1eb05ad9a2fe3f
SHA1053733b31efcab28d6548a9edbf03e963b43b18c
SHA25690cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3
SHA512a2e3731c3e80e890e768a18fc8ca4a9c40b1486b4f1729b32d36df7870885c5da36942f1c0a0c3c0187b8404d1c3fcab8a61e620bf3717e7fe9f7bcc343c6542
-
\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeFilesize
302KB
MD5a359f00c1f48a7d4bb1eb05ad9a2fe3f
SHA1053733b31efcab28d6548a9edbf03e963b43b18c
SHA25690cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3
SHA512a2e3731c3e80e890e768a18fc8ca4a9c40b1486b4f1729b32d36df7870885c5da36942f1c0a0c3c0187b8404d1c3fcab8a61e620bf3717e7fe9f7bcc343c6542
-
\Users\Admin\AppData\Local\Temp\4056a6ad6e\ftewk.exeFilesize
302KB
MD5a359f00c1f48a7d4bb1eb05ad9a2fe3f
SHA1053733b31efcab28d6548a9edbf03e963b43b18c
SHA25690cc787870f37ff7bd617976d253b613eab4fcbe65fb31cf3890efeb6636d9d3
SHA512a2e3731c3e80e890e768a18fc8ca4a9c40b1486b4f1729b32d36df7870885c5da36942f1c0a0c3c0187b8404d1c3fcab8a61e620bf3717e7fe9f7bcc343c6542
-
memory/828-60-0x0000000000000000-mapping.dmp
-
memory/828-63-0x00000000002C0000-0x00000000002F8000-memory.dmpFilesize
224KB
-
memory/828-64-0x0000000000400000-0x0000000000664000-memory.dmpFilesize
2.4MB
-
memory/904-65-0x0000000000000000-mapping.dmp
-
memory/1044-69-0x0000000000000000-mapping.dmp
-
memory/1044-72-0x0000000000400000-0x0000000000664000-memory.dmpFilesize
2.4MB
-
memory/1400-55-0x00000000003D0000-0x00000000003ED000-memory.dmpFilesize
116KB
-
memory/1400-56-0x0000000000800000-0x0000000000838000-memory.dmpFilesize
224KB
-
memory/1400-54-0x0000000075E41000-0x0000000075E43000-memory.dmpFilesize
8KB
-
memory/1400-57-0x0000000000400000-0x0000000000664000-memory.dmpFilesize
2.4MB
-
memory/1536-73-0x0000000000000000-mapping.dmp
-
memory/1536-76-0x0000000000400000-0x0000000000664000-memory.dmpFilesize
2.4MB
-
memory/1628-66-0x0000000000000000-mapping.dmp
-
memory/1704-67-0x0000000000000000-mapping.dmp
-
memory/1980-77-0x0000000000000000-mapping.dmp
-
memory/1980-80-0x0000000000400000-0x0000000000664000-memory.dmpFilesize
2.4MB