ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e

Analysis

max time kernel
140s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe
Size

426KB
MD5

474c5380363a7076e57052d7b52ac832
SHA1

81e2c47b741770fdcfede9ee2046f71cbe7b316d
SHA256

ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e
SHA512

9fa2e9a53f42ffe4f8be86683ab73b72e956a9f1193eaedc3b34ea42e0a718f82412e2c667d8b45ce9d52e793eaaf4772d50e28cecd326471a677532e370c295
SSDEEP

12288:zVrpgNZm38G331gAy5ozOvfMwuYXuC5B4:zbCjcG/uYeoy

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3604-132-0x0000000000400000-0x0000000000439000-memory.dmp	upx
behavioral2/memory/3604-134-0x0000000000400000-0x0000000000439000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3604	ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe
3604	ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3604	ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 2960	3604	ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe	82
PID 3604 wrote to memory of 2960	3604	ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe	82
PID 3604 wrote to memory of 2960	3604	ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe	82

C:\Users\Admin\AppData\Local\Temp\ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe
"C:\Users\Admin\AppData\Local\Temp\ee50ce56f68f785ab41b25885fca3b57f2cfe4539c46bba6e9ad8ec3cf68dd0e.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EE50CE~1.EXE > nul
  2⤵
  PID:2960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3604-132-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3604-134-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download