Analysis
-
max time kernel
149s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 18:07
Static task
static1
Behavioral task
behavioral1
Sample
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe
Resource
win7-20220718-en
General
-
Target
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe
-
Size
120KB
-
MD5
7cd51ed7687a080cbf8cb1ce8c809822
-
SHA1
f5287b9f5ebfc74b63d9d059be5684c8bf05e583
-
SHA256
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe
-
SHA512
131ec0c2c25f0a946d16553115fdd6a347b87d73b73b9ee514bfc4148e09249186cc1a64e9931ea0a3b42516fc60f62b7072e1cd5784d78e834b53fd3a73a255
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
tracemheg.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat tracemheg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
tracemheg.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 tracemheg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\WpadDecisionReason = "1" tracemheg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-fd-da-49-6e-f8 tracemheg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-fd-da-49-6e-f8\WpadDecision = "0" tracemheg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\WpadDecision = "0" tracemheg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\ca-fd-da-49-6e-f8 tracemheg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 tracemheg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" tracemheg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad tracemheg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0} tracemheg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections tracemheg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\WpadDecisionTime = d0bb5ca78a9cd801 tracemheg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\WpadNetworkName = "Network 3" tracemheg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-fd-da-49-6e-f8\WpadDecisionReason = "1" tracemheg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings tracemheg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings tracemheg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 tracemheg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-fd-da-49-6e-f8\WpadDecisionTime = d0bb5ca78a9cd801 tracemheg.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exetracemheg.exetracemheg.exepid process 1924 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 992 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 1748 tracemheg.exe 1784 tracemheg.exe 1784 tracemheg.exe 1784 tracemheg.exe 1784 tracemheg.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exepid process 992 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exetracemheg.exedescription pid process target process PID 1924 wrote to memory of 992 1924 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe PID 1924 wrote to memory of 992 1924 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe PID 1924 wrote to memory of 992 1924 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe PID 1924 wrote to memory of 992 1924 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe PID 1748 wrote to memory of 1784 1748 tracemheg.exe tracemheg.exe PID 1748 wrote to memory of 1784 1748 tracemheg.exe tracemheg.exe PID 1748 wrote to memory of 1784 1748 tracemheg.exe tracemheg.exe PID 1748 wrote to memory of 1784 1748 tracemheg.exe tracemheg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe"C:\Users\Admin\AppData\Local\Temp\4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe"C:\Users\Admin\AppData\Local\Temp\4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\tracemheg.exe"C:\Windows\SysWOW64\tracemheg.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tracemheg.exe"C:\Windows\SysWOW64\tracemheg.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/992-68-0x0000000000810000-0x0000000000833000-memory.dmpFilesize
140KB
-
memory/992-86-0x0000000000160000-0x0000000000176000-memory.dmpFilesize
88KB
-
memory/992-59-0x0000000000000000-mapping.dmp
-
memory/992-60-0x0000000000290000-0x00000000002A6000-memory.dmpFilesize
88KB
-
memory/992-64-0x0000000000290000-0x00000000002A6000-memory.dmpFilesize
88KB
-
memory/992-71-0x00000000768F1000-0x00000000768F3000-memory.dmpFilesize
8KB
-
memory/992-70-0x0000000000180000-0x0000000000190000-memory.dmpFilesize
64KB
-
memory/992-69-0x0000000000160000-0x0000000000176000-memory.dmpFilesize
88KB
-
memory/1748-85-0x0000000000190000-0x00000000001A0000-memory.dmpFilesize
64KB
-
memory/1748-84-0x0000000000150000-0x0000000000166000-memory.dmpFilesize
88KB
-
memory/1748-72-0x0000000000170000-0x0000000000186000-memory.dmpFilesize
88KB
-
memory/1748-76-0x0000000000170000-0x0000000000186000-memory.dmpFilesize
88KB
-
memory/1748-83-0x0000000000810000-0x0000000000833000-memory.dmpFilesize
140KB
-
memory/1784-77-0x0000000000000000-mapping.dmp
-
memory/1784-88-0x0000000000110000-0x0000000000126000-memory.dmpFilesize
88KB
-
memory/1784-87-0x0000000000810000-0x0000000000833000-memory.dmpFilesize
140KB
-
memory/1784-90-0x0000000000110000-0x0000000000126000-memory.dmpFilesize
88KB
-
memory/1924-58-0x0000000000130000-0x0000000000146000-memory.dmpFilesize
88KB
-
memory/1924-54-0x0000000000130000-0x0000000000146000-memory.dmpFilesize
88KB
-
memory/1924-66-0x0000000000110000-0x0000000000126000-memory.dmpFilesize
88KB
-
memory/1924-65-0x0000000000810000-0x0000000000833000-memory.dmpFilesize
140KB
-
memory/1924-67-0x0000000000190000-0x00000000001A0000-memory.dmpFilesize
64KB